Network Bytes · Episode 14 · CCNA 1.5
The TCP three-way handshake
Almost every website you open starts with a three-step greeting. Here's how TCP's SYN, SYN-ACK and ACK set up a connection, and how TCP resends anything that gets lost.
What TCP is for
TCP, the Transmission Control Protocol, is the part of the network that makes sure your data arrives complete and in order. Web pages, email and file downloads all ride on it. It's called connection-oriented: before it sends anything, it sets up a connection with the other side, so both know a conversation is starting.
The three steps
- SYN (short for synchronize): your device says "Hey, can we talk?" It also picks a starting number for counting the bytes it will send, for example
seq = 100. - SYN-ACK: the server answers "Yep, I hear you. Can you hear me?" It confirms your number (
ack = 101) and picks its own starting number (seq = 300). - ACK (short for acknowledge): your device says "Loud and clear" and confirms the server's number (
ack = 301).
Now both sides have heard each other and agreed on where counting starts. The connection is established, and the real data can flow in both directions.
Why bother?
Those starting numbers are the whole point. Every piece of data TCP sends carries a sequence number, and the receiver sends back acknowledgments for what arrived. If a packet goes missing, the sender notices that it was never acknowledged and retransmits it. The receiver uses the sequence numbers to put everything back in order. That's why your downloads don't show up with missing pieces.
Try it yourself
On a Windows, Mac or Linux computer, open a terminal and run netstat -an while a web page is open. Lines marked ESTABLISHED are TCP connections that finished their three-way handshake; many will be to port 443, secure web traffic. You may also spot SYN_SENT for a connection that is still saying hello.
Good to know
- The video's "almost" is on purpose: newer HTTP/3 traffic runs over QUIC, which uses UDP instead of TCP.
- For a secure site (HTTPS), a separate TLS handshake for encryption happens right after the TCP handshake.
- The starting sequence numbers in the video (100 and 300) are made up to keep the math easy. Real ones are chosen at random.
For CCNA learners
This lines up with CCNA 200-301 exam topic 1.5, compare TCP to UDP: know that TCP is connection-oriented, opens with the SYN, SYN-ACK, ACK handshake, and uses sequence numbers and acknowledgments for reliable, in-order delivery.
Test your knowledge
Quick quiz: The TCP three-way handshake
4 multiple-choice questions. Pick one answer for each, then check how you did.
Sources
- IETF, "RFC 9293: Transmission Control Protocol (TCP)": connections open with the SYN, SYN-ACK, ACK three-way handshake; sequence numbers and retransmission give reliable, in-order delivery
- Cloudflare Learning Center, "What is TCP/IP?": TCP sets up a connection with a handshake, then numbers, acknowledges and resends packets
- Cisco, CCNA 200-301 v1.1 exam topics: 1.5 compare TCP to UDP
Video transcript
Almost every website you've ever opened started with a polite three-step greeting.
It's called the TCP three-way handshake. TCP is the protocol that makes sure your data arrives complete and in order. Before it sends anything, it checks that both sides are ready.
Step one: your device sends a SYN, short for synchronize. Basically, "Hey, can we talk?"
Step two: the server replies with a SYN-ACK. "Yep, I hear you. Can you hear me?"
Step three: your device sends an ACK, short for acknowledge. "Loud and clear." Now the real data can flow.
Why bother? Because TCP keeps checking the whole time. If a packet goes missing later, TCP notices and sends it again. That's why your downloads don't show up with missing pieces.