TCP Handshake¶

1. What is it? (2-3 lines)¶

The TCP Handshake (Three-Way Handshake) is the 3-step connection initialization protocol used by Transmission Control Protocol (TCP) to establish a reliable, full-duplex, sequence-numbered socket connection between a client and a server.

2. Why does it exist?¶

IP networks are inherently unreliable and connectionless (best-effort packet delivery). The TCP Three-Way Handshake synchronizes initial Sequence Numbers (ISN), negotiates window sizes, establishes socket state on both endpoints, and verifies bi-directional connectivity before any application data is sent.

3. Where is it used?¶

Transport Layer Protocol (L4): Underpins HTTP/1.1, HTTP/2, gRPC, PostgreSQL, MySQL, Redis, SSH, TLS.

4. How does it work? (simple flow)¶

SYN (Client \(\to\) Server): Client sends TCP packet with SYN flag set, a random initial sequence number Seq = x, and proposed options (MSS, Window Scale). Client enters SYN_SENT state.
SYN-ACK (Server \(\to\) Client): Server receives SYN, allocates socket memory, responds with SYN-ACK flags set, server ISN Seq = y, and acknowledgment Ack = x + 1. Server enters SYN_RCVD state.
ACK (Client \(\to\) Server): Client receives SYN-ACK, responds with ACK flag set, Seq = x + 1, and Ack = y + 1. Both endpoints enter ESTABLISHED state.
Note: Client can piggyback early HTTP application payload data inside the 3rd ACK packet!

Client                             Server
  | ----- SYN (Seq=x) ---------->    |  (1 RTT Latency Cost)
  | <---- SYN-ACK (Seq=y, Ack=x+1) - |
  | ----- ACK (Seq=x+1, Ack=y+1) ->  |  [Connection ESTABLISHED]

5. Latency Cost & Fast Open¶

1 RTT Penalty: Establishing a new TCP connection incurs 1 Round-Trip Time (RTT) of network latency before data transmission.
TCP Fast Open (TFO): Allows client to send data inside the initial SYN packet using a cryptographic TFO cookie, eliminating the 1 RTT connection setup penalty for returning clients.

6. Limitations & Vulnerabilities¶

SYN Flood Attack: Attacker sends millions of spoofed SYN packets without sending final ACKs, filling the server's SYN Backlog Queue and causing denial of service (Mitigated by SYN Cookies).
Connection Teardown: Closing a connection requires a separate 4-step FIN-ACK handshake (FIN \(\to\) ACK \(\to\) FIN \(\to\) ACK) leaving sockets in TIME_WAIT for \(2 \times \text{MSL}\) (Maximum Segment Lifetime).

7. Common interview questions (10)¶

Walk through the step-by-step state machine transitions of the TCP 3-Way Handshake.
Why is the handshake 3 steps (SYN, SYN-ACK, ACK) instead of 2 or 4 steps?
What is a SYN Flood attack and how do SYN Cookies mitigate it without allocating server memory?
How does TCP Fast Open (TFO) achieve 0-RTT connection setup for returning clients?
What is the difference between the somaxconn (Accept Queue) and tcp_max_syn_backlog (SYN Queue) in Linux kernel tuning?
How does the 4-step TCP Teardown (FIN/ACK) work and what is the purpose of the TIME_WAIT state?
What is Maximum Segment Size (MSS) and how is it negotiated during the SYN handshake?
How does TCP Sequence Number randomization protect against IP Spoofing and Connection Hijacking?
How does HTTP Keep-Alive avoid repeated TCP 3-Way Handshake overhead?
How does QUIC (HTTP/3 over UDP) eliminate TCP handshake latency overhead?

8. Common misconceptions¶

Misconception: Application data can never be sent in the 3-Way Handshake. Fact: The 3rd ACK packet sent by the client CAN carry application data payloads. TCP Fast Open allows data in the 1st SYN packet.
Misconception: TIME_WAIT is a bug/leak in Linux. Fact: TIME_WAIT is a mandatory safety state ensuring delayed network packets die before a new socket reuses the same IP:Port tuple.

10. 30-second cheat sheet¶

Steps: SYN (Client) \(\to\) SYN-ACK (Server) \(\to\) ACK (Client).
Latency Cost: Costs 1 RTT before first data byte can be sent.
SYN Flood Fix: Enable SYN Cookies in Linux kernel (net.ipv4.tcp_syncookies = 1).
Optimization: Use HTTP Keep-Alive & Connection Pools to reuse ESTABLISHED sockets!