The TCP Three-Way Handshake

Opening

1. SYN: the client picks a random initial sequence number and asks to connect.
2. SYN-ACK: the server acknowledges it and sends its own sequence number.
3. ACK: the client acknowledges the server's number. The connection is ESTABLISHED.

Sequence numbers let each side put data in order and detect what's missing, which is what makes TCP reliable.

What failures look like

• No reply to SYN: a firewall dropped it, or the host is unreachable: a connection timed out after retries.
• RST in reply to SYN: nothing is listening on that port: connection refused.

Closing

Either side sends FIN; the other acknowledges and sends its own FIN. The side that closed first waits in TIME_WAIT for a while to catch stray packets. A RST aborts a connection immediately (connection reset by peer).

Why it matters for speed

The handshake costs a full round trip before data, and TLS adds another. That's why latency matters so much for page loads, and why TLS 1.3, TCP Fast Open and QUIC work to reduce round trips.

$ sudo tcpdump -i en0 -n 'tcp[tcpflags] & (tcp-syn) != 0 and host 1.1.1.1'
IP 192.168.1.23.53621 > 1.1.1.1.443: Flags [S], seq 1830237467, …
IP 1.1.1.1.443 > 192.168.1.23.53621: Flags [S.], seq 2401195339, ack 1830237468, …

[S] is SYN and [S.] is SYN-ACK. Run curl -sI https://1.1.1.1 in another window to trigger it.

• netstat -an -p tcp shows every connection's state: SYN_SENT, ESTABLISHED, TIME_WAIT, CLOSE_WAIT.
• nc -vz host 443 performs just the handshake and reports whether it succeeded.
• curl -w '%{time_connect}\n' -o /dev/null -s https://example.com prints the handshake time.

LightAtom's connections view shows each app's TCP connections and their state, from the first SYN to close.