All application processes on a server use unique port numbers. A network administrator can use default ports (e.g., 80 for HTTP, 21 for FTP) or configure custom ports manually, ensuring no conflicts. An active server application listening on an open port means the transport layer accepts and processes segments addressed to that port number. Every client’s incoming request is matched to the correct socket address, and the application receives the data. Multiple ports can be open simultaneously on the same server, one for each active server application.
This guide covers exactly how a TCP connection is established via the three-way handshake, how it’s gracefully closed via the four-way termination sequence, and the additional mechanisms, sequence number synchronization, the RST flag, and the TIME_WAIT state, that a complete understanding of TCP connection management requires.
TCP Connection Establishment
When two people meet, they often shake hands as a greeting. Establishing a connection in networking works similarly. A host and server — or any two hosts — set up a TCP connection through an equivalent three-step handshake. The client requests a client-to-server communication session with the server.
When the server receives this request, it acknowledges the client-to-server session and simultaneously requests a server-to-client session of its own. The initiating client then acknowledges that server-to-client session. This is the TCP three-way handshake:
- SYN: The client sends a segment with the SYN (Synchronize) flag set, along with its own randomly generated Initial Sequence Number (ISN), to the server.
- SYN-ACK: The server responds with a segment that has both the SYN and ACK flags set, acknowledging the client’s ISN (by returning ISN+1) and including its own randomly generated ISN.
- ACK: The client sends a final segment with the ACK flag set, acknowledging the server’s ISN (by returning ISN+1).
Why the Handshake Exchanges Sequence Numbers
The three-way handshake isn’t just a greeting ritual, its core technical purpose is synchronizing Initial Sequence Numbers in both directions. Each side generates its own random ISN specifically to prevent an old, delayed segment from a previous connection being mistaken for part of a new one, a scenario the TCP specification explicitly guards against. Once both ISNs are exchanged and acknowledged, both sides can reliably track exactly which bytes of the data stream have been sent and received in each direction, which is what allows TCP to detect loss, reorder out-of-sequence segments, and retransmit reliably for the rest of the connection’s life.
TCP Session Termination
After the connection is established and data transfer is complete, the connection must be terminated cleanly. The FIN (Finish) control flag is used for this purpose. Because a TCP connection is full-duplex (data flows independently in both directions), each direction must be closed separately using its own FIN/ACK exchange, a two-way handshake. Closing both directions of a single TCP conversation therefore requires four exchanges total, commonly called the four-way termination.
- Host → FIN → Server: When a host has sent all its data and has no more to send, it sends a segment with the FIN flag set to the server.
- Server → ACK → Host: The server sends an ACK, acknowledging receipt of the FIN and closing the host-to-server direction of the session.
- Server → FIN → Host: Once the server has also finished sending its own data, it sends its own FIN to the host, initiating closure of the server-to-host direction.
- Host → ACK → Server: The host responds with a final ACK, acknowledging the server’s FIN.
Once this final acknowledgment is received, the connection is fully terminated in both directions. See a detailed community discussion of the termination process for additional worked examples.
The TIME_WAIT State
After sending the final ACK in step 4, the host that sent it doesn’t close the connection immediately. Instead, it enters a TIME_WAIT state for a defined period (commonly twice the Maximum Segment Lifetime, or 2MSL) before fully releasing the connection’s resources. This waiting period exists specifically to handle the case where that final ACK is lost in transit; if the server doesn’t receive it, it will retransmit its FIN, and the host needs to still be listening in TIME_WAIT to respond correctly rather than having already moved on. A high volume of connections stuck in TIME_WAIT is a common, specific symptom investigated during high-traffic server troubleshooting.
Abrupt Termination with RST
Not every TCP connection ends gracefully through the four-way FIN/ACK sequence. The RST (Reset) flag provides a way to abruptly terminate a connection immediately, without the graceful multi-step exchange. A device sends a segment with RST set when it receives data for a connection it has no record of (for example, after a crash and restart), when an application actively refuses a connection, or when a serious error makes graceful closure impossible. Unlike the four-way termination, a RST segment requires no acknowledgment and immediately tears down the connection on both ends, which is precisely why abrupt termination can risk data loss for any data that was in transit but not yet acknowledged at the time of the reset.
TCP Connection Lifecycle Simulator
The interactive simulator below visually walks through both the three-way handshake (Connection Establishment) and the four-way termination (Connection Termination) step by step, showing the exact segment flags exchanged between Host and Server at each stage.
[Interactive simulator: toggles between Connection Establishment and Connection Termination views, with Step 1–3 (SYN, SYN-ACK, ACK) and Step 1–4 (FIN, ACK, FIN, ACK) buttons, an Auto Run option, adjustable animation speed, and a Reset control.]
🌐 TCP Lifecycle handshake · termination
TCP 3-Way Handshake (Connection Establishment):
- SYN: Client sends SYN packet, including its ISN, to initiate the connection
- SYN-ACK: Server responds with a SYN-ACK packet, acknowledging the client’s ISN and including its own
- ACK: Client sends an ACK packet, acknowledging the server’s ISN, completing the handshake
After this process, the TCP connection is established and reliable, sequenced data transfer can begin.
TCP 4-Way Handshake (Connection Termination):
- FIN (Host): Host sends FIN to indicate it has no more data to send
- ACK (Server): Server acknowledges the host’s FIN
- FIN (Server): Server sends its own FIN once it is also ready to stop sending
- ACK (Host): Host acknowledges the server’s FIN; the host then enters TIME_WAIT before fully closing
After this process, the TCP connection is fully terminated in both directions.
Note for republishing: confirm the interactive simulator’s controls (Send SYN, Send SYN-ACK, Send ACK, Auto Run, Reset, and the equivalent termination controls) function correctly in a live browser test before this update goes live.
Verifying TCP Connections in Practice
Beyond the theory, TCP connection states can be observed directly on both endpoint operating systems and network devices.
On a Windows or Linux host:
netstat -an | find "ESTABLISHED"
netstat -an | find "TIME_WAIT"This shows every currently active TCP connection and its state, ESTABLISHED for connections that have completed the three-way handshake and are actively exchanging data, TIME_WAIT for connections that have completed the four-way termination and are in their post-close waiting period, and other states like SYN_SENT or SYN_RECEIVED for handshakes still in progress.
A packet capture tool such as Wireshark makes the flag exchange directly visible, showing the [SYN], [SYN, ACK], [ACK] flag sequence for establishment and the [FIN, ACK] / [ACK] sequence for termination on the wire, which is the most direct way to confirm this entire process matches what’s described above on a real, live connection.
CCNA Exam Pointers
- Three-way handshake: SYN → SYN-ACK → ACK
- Four-way termination: FIN → ACK → FIN → ACK (each direction of the full-duplex connection closes independently)
- The handshake’s core purpose is synchronizing Initial Sequence Numbers (ISN) in both directions, not just confirming reachability
- RST abruptly tears down a connection with no acknowledgment required — used for errors, refused connections, or connections with no matching state
- TIME_WAIT follows the final ACK of termination, typically lasting 2×MSL, to handle a potentially lost final ACK
netstat -an— shows TCP connection states (ESTABLISHED, TIME_WAIT, SYN_SENT, etc.) on an endpoint- TCP is full-duplex: each direction of data flow is established and terminated independently, which is exactly why termination requires four exchanges instead of two
Conclusion
TCP’s three-way handshake establishes a connection by exchanging and synchronizing Initial Sequence Numbers in both directions, the actual mechanism that enables TCP’s reliability guarantees for the rest of the connection’s life, not merely a formality. Because TCP is full-duplex, graceful termination requires four exchanges, one FIN/ACK pair per direction, followed by a TIME_WAIT period on the side that sent the final acknowledgment. Understanding the RST flag’s role in abrupt termination, and being able to observe real connection states with netstat or a packet capture, completes the picture beyond the textbook handshake diagram and connects directly to real-world TCP troubleshooting.
FAQs
What is the TCP three-way handshake?
The TCP three-way handshake establishes a connection through three segments: the client sends a SYN containing its Initial Sequence Number, the server responds with a SYN-ACK acknowledging that number and providing its own, and the client sends a final ACK acknowledging the server’s number. Beyond simply confirming both sides are reachable, this exchange synchronizes the sequence numbers each side will use to track exactly which bytes have been sent and received, which is the actual mechanism underpinning TCP’s reliability.
How does TCP connection termination work?
TCP termination uses a four-way exchange because TCP connections are full-duplex, meaning each direction of data flow must be closed independently. The host sends a FIN when it has no more data to send, the server acknowledges with an ACK and later sends its own FIN once it is also finished, and the host sends a final ACK acknowledging that. The side that sent the final ACK then enters a TIME_WAIT state for a defined period before fully releasing the connection.
Why is the three-way handshake important in TCP?
The three-way handshake is crucial primarily because it synchronizes Initial Sequence Numbers in both directions before any application data is exchanged. This synchronization is what allows TCP to detect lost segments, reorder segments that arrive out of sequence, and reliably retransmit missing data for the entire lifetime of the connection. Without this initial synchronization step, TCP’s core reliability guarantees would not be possible.
What happens during TCP four-way termination?
During four-way termination, each of the two directions of the full-duplex connection is closed with its own independent FIN and ACK exchange. The host initiates by sending a FIN once it has no more data to send; the server acknowledges this and, once it too has finished sending, sends its own FIN; the host sends a final ACK to acknowledge the server’s FIN. After sending that final ACK, the host enters a TIME_WAIT state rather than closing immediately, specifically to handle the possibility that the final ACK was lost and the server’s FIN needs to be retransmitted and re-acknowledged.
Can TCP connections be terminated abruptly?
Yes. While the four-way FIN/ACK exchange is the graceful, standard termination method, TCP also supports abrupt termination using the RST (Reset) flag. A RST is sent when a device receives data for a connection it has no matching state for, such as after a crash and restart, when an application actively refuses an incoming connection, or when an unrecoverable error occurs. Unlike graceful termination, an RST requires no acknowledgment and closes the connection immediately on both ends, which means any data in transit but not yet acknowledged at that moment can be lost.
How can I see TCP connection states on my own computer?
On both Windows and Linux, the netstat -an command lists every active TCP connection along with its current state. Connections that have completed the three-way handshake and are actively exchanging data show as ESTABLISHED; connections that have completed the four-way termination and are in their post-close waiting period show as TIME_WAIT; connections with a handshake still in progress show intermediate states like SYN_SENT or SYN_RECEIVED. For a more detailed, byte-level view of the actual flag exchange, a packet capture tool such as Wireshark shows the SYN, SYN-ACK, ACK, FIN, and RST flags directly on the wire.
