Lesson 3.8: TCP: the three-way handshake, flags and connection states
How TCP makes an unreliable network reliable: connections, sequence and acknowledgement numbers, the three-way handshake, the flags (SYN, ACK, PSH, FIN, RST), how a connection is closed, what a reset means, the connection states you see in ss, and the SYN flood attack that abuses the handshake. In the lab you read a whole web connection in a capture from first SYN to last ACK, watch a closed port answer with a reset, check connection states on your laptop and count a flood of half-open connections.
19 min
You will learn to
- Explain what makes TCP reliable
- Describe the three-way handshake
- Read TCP flags in a capture
- Explain FIN and RST
- Recognise a SYN flood
Key terms
- TCP
- A connection-oriented transport protocol that delivers a stream of bytes completely and in order, re-sending what gets lost.
- Sequence and acknowledgement numbers
- Every byte sent gets a number; the receiver answers with the number it expects next, confirming everything before it.
- Three-way handshake
- How TCP opens a connection: SYN, SYN-ACK, ACK.
- TCP flags
- Bits in the TCP header that mark a packet's purpose: SYN start, ACK acknowledge, PSH push data now, FIN finish, RST reset (abort).
- Connection state
- Where a TCP connection is in its life: LISTEN, SYN-SENT, SYN-RECEIVED, ESTABLISHED, FIN-WAIT, CLOSE-WAIT, TIME-WAIT, CLOSED…
- SYN flood
- A denial-of-service attack that sends huge numbers of SYNs and never completes the handshakes, filling the server's table of half-open connections.
← Working with files and directories · All lessons · Defence in depth and least privilege →