TCP Three-Way Handshake Explained
Two hosts agree on initial sequence numbers before any data moves. We trace the three packets — SYN, SYN-ACK, ACK — and show what each side records when it receives them: the other host's ISN, its own next expected sequence, and the state transition from LISTEN to ESTABLISHED.
Topics covered:
- Why sequence numbers must be synchronized in both directions
- The packets: SYN with an ISN, SYN-ACK with both numbers, ACK
- State transitions on both hosts: LISTEN, SYN-SENT, SYN-RECEIVED, ESTABLISHED
- What the handshake does not do: no authentication, no congestion state
- SYN cookies: how a kernel defends against handshake floods
- Fast Open and why the handshake survives IPv6 unchanged
Related articles
TCP Nagle and Delayed ACK: Why Small Writes Stall for 40ms
The Nagle algorithm and delayed ACK interaction that adds a 40ms stall to small writes, how to see it in tcpdump, and when TCP_NODELAY actually helps.
TCP Congestion Control Explained: Slow Start, cwnd, and Bufferbloat
How TCP congestion control actually works — slow start, AIMD, cwnd, Reno vs CUBIC vs BBR, fast retransmit, and the bufferbloat problem you can observe with ss.
TLS 1.3 Handshake Round Trips: 1-RTT, PSK Resumption, and 0-RTT
The TLS 1.3 handshake in one round trip — key shares, the transcript signature, session resumption with PSKs, and the replay risks of 0-RTT data.
More in Networking
HTTP/3 and QUIC Explained
The transport protocol that replaces TCP — multiplexing without head-of-line blocking, connection migration, and 0-RTT.
WatchThe Full Lifecycle of an HTTP Request
Watch a single request travel from a browser through DNS, TCP, TLS, HTTP, a load balancer, a server, and a database — with live packet-level tracing.
WatchIP Routing Explained
How a packet travels from host to host — longest-prefix matching in forwarding tables, next-hop resolution, and what actually changes at every router along the way.
DetailsLoad Balancing Protocols
Layer 4 vs. layer 7 balancing, NAT rewrites, and health checks — the actual packet and request flows that distribute traffic across a backend pool.
DetailsSockets and the Network Stack
The path a byte takes from a syscall to the wire — sockets, kernel buffers, queues, and protocol layers, and where sendto and recvfrom actually do their work.
DetailsCongestion Control Visualized
How TCP probes for available bandwidth — slow start, congestion avoidance, and packet loss as the signal that tells senders when to back off.
DetailsHTTP/2 and HTTP/3
Streams, frames, and the transports underneath — what HTTP/2 multiplexing changes at the application layer and what moving to QUIC changes at the transport layer.
DetailsTLS Handshake Explained
The cryptographic negotiation inside TLS 1.3 — key exchange, certificate validation, and the single round trip that encrypts everything after it.
DetailsDNS Resolution Visualized
Follow a query from stub resolver to authoritative server — cache hits, recursive walking, TTL expiry, and the exact packet flow that turns a hostname into an IP.
DetailsDepth, delivered weekly
One technical dispatch a week — articles and episode notes before they go public.
One technical dispatch per week. No noise.