Describe the TCP three-way handshake.

A strong answer

A strong candidate frames Describe the TCP three-way handshake. around the exact memory layout, compiler semantics, and hardware execution model covered in Socket Foundations: Berkeley Sockets, Address Structures, and TCP Handshakes. Explain SYN, SYN-ACK, ACK, sequence numbers, and how socket() and connect() participate.

Throughout earlier modules, we relied on the Unix philosophy: everything is a file. File descriptors represent streams of bytes whether targeting disk files, anonymous pipes, or terminal output.

However, standard file operations are fundamentally local:

• A disk file already exists at a fixed path.
• A pipe connects two processes executing on the same CPU with a common ancestry tree.

In a production interview, always connect the specification rule to its concrete runtime consequence: state what lives on the stack versus the heap or static storage segment, how the compiler or operating system validates alignments, lifetimes, and error codes, and what happens under adversarial or boundary inputs (such as zero-length buffers, integer overflow, concurrent mutation, or partial I/O). Backing your explanation with a small trace of register/memory state transitions immediately separates senior systems engineers from candidates who only memorized syntax.

What the interviewer is listening for

• Mastery of core invariant: Instantiate stream sockets and bind endpoints using socket, sockaddr_in, and bind.
• Mastery of core invariant: Transition passive listening sockets into connection queues using listen and accept.
• Mastery of core invariant: Convert host integer representations to big-endian network byte order using htons and htonl.
• Hardware and ABI awareness: Explaining how sizes, alignments, calling conventions, or kernel boundaries behave on real 64-bit targets rather than relying on implementation-defined assumptions.
• Defensive engineering: Naming the exact compiler flags (-Wall -Wextra -Werror), static analyzers, or runtime sanitizers (-fsanitize=address,undefined,thread) that verify correctness in CI.

Common mistakes

• Explaining only surface syntax without tracing the underlying memory addresses, ownership lifetime, or kernel/user-space state transitions.
• Assuming undefined behavior (such as signed overflow, uninitialized reads, strict-aliasing violations, or dangling pointers) will "just work" because it passed an unoptimized -O0 debug build.
• Ignoring return codes, partial reads/writes, alignment padding, or cleanup paths when an allocation or syscall fails midway through a function.