The first part of this article will give an overview of the handshake after which we'll dive deeper and see what the network traffic looks like. It begins with a handshake and ends with a termination session. Transmission Control protocol (TCP) is a connection oriented protocol. MSS ( maximum segment size) negotiation occurs in this steps.This article describes the TCP 3-way handshake and builds upon this knowledge to explain technically how port scanning works. But in practice, at times, TCP 3-way handshake not only just initiates the connection, but also negotiate some very important parameters. So the sequence number of the confirm packet is seq=x+1. ACK packet could take data content, if not, this packet will not consume SYN number. TCB-Transmission Control Block, something like PCB, it stores some significant info like, TCP connectio table, the pointer for the sending and receiving buffer, retransmission queue pointer, the current sequence number and acknowledge number and ext. This is what we called three-way handshake. Īfter that, both side gose into ESTABLISHED status.

After the host received the server's response, it will send back also a confirm packet with ACK bit sets to '1' and seq=x+1, ack=y+1. If the server rejects the connection, it just responses a RST packet to reset the connection.Ĥ. And the server goes into SYN-RCVD status. This packet can not take any data content either, but it consumes a sequence number. The server will send its sequence number within packet which is used to be acknowledged to the clinet's SYN packet. In the response both SYN and ACK bits should be '1', and server side also initiates a SEQ number, seq=y.

If the server accept to this connection, it will send back a confirm response. After request sent, the host goes into SYN-SENT status.

SYN paccket (which means SYN=1) can not take any data content, but it will consume a sequence number.

The host does the same thing, create a TCB and use this TCB to send request, set the 'SYN=1' in the request header, and initates a arbitrary sequence number, seq=x. After TCB born the server change status to LISTEN.Ģ. The server process create a TCB and use TCB prepares to accept the host's request. We assume that both host (A) and server (B) side start from CLOSED status.ġ.

Wireshark pcap 3 way handshake