Stage 3 · Build
TCP/IP Fundamentals
TCP: The Handshake & Connection
SYN/SYN-ACK/ACK, FIN/RST, sequence numbers, and connection states.
Inside the TCP Header
TCP (Transmission Control Protocol) provides reliable, ordered, byte-stream delivery over IP. Every TCP segment carries a 20-byte base header with source port, destination port, sequence number, acknowledgment number, flags, window size, and checksum.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Acknowledgment Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Data | |C|E|U|A|P|R|S|F| |
| Offset| Rsrvd |W|C|R|C|S|S|Y|I| Window |
| | |R|E|G|K|H|T|N|N| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The flags (SYN, ACK, FIN, RST) control the connection lifecycle. Sequence and acknowledgment numbers enable reliable delivery by tracking which bytes have been sent and received.
The Three-Way Handshake
Before sending data, TCP establishes a connection with a three-way handshake. This synchronizes sequence numbers and negotiates connection parameters.
Client Server
| |
|--- SYN (seq=100) ------>| Client proposes initial sequence
| |
|<-- SYN-ACK (seq=300, | Server acknowledges and proposes
| ack=101) -----------| its own sequence
| |
|--- ACK (ack=301) ------>| Client acknowledges server's seq
| |
| Connection established |The handshake uses three messages because both sides need to agree on initial sequence numbers. Two messages are not enough — the server needs to know its SYN-ACK was received.
If the client's ACK were lost, the server would think the connection is established but the client would not. With three messages, both sides have confirmed the other received their initial sequence number before data flows.
Data Transfer and Sequence Numbers
Every byte sent is assigned a sequence number. The receiver acknowledges data with ACK segments that carry the next expected sequence number. This allows the sender to detect lost segments and retransmit them.
Client Server
| |
|--- PSH (seq=101, 100 bytes)-->|
| |
|<-- ACK (ack=201) -------------| "I got bytes 101-200"
| |
|--- PSH (seq=201, 50 bytes)--->|
| |
|<-- ACK (ack=251) -------------| "I got bytes 201-250"The ACK number is always the next byte expected, not the last byte received. ACK 201 means I have received up to byte 200 and expect byte 201 next.
Connection Teardown
TCP connections terminate gracefully with a four-way FIN exchange. Either side can initiate the close. The side that sends FIN enters FIN-WAIT and the receiver enters CLOSE-WAIT.
Client Server
| |
|--- FIN (seq=500) ------>| Client wants to close
| |
|<-- ACK (ack=501) -------| Server acknowledges
| | (server may still send data)
| |
|<-- FIN (seq=800) -------| Server also done
| |
|--- ACK (ack=801) ------>| Client acknowledges
| |
| TIME-WAIT (2MSL) | Wait to ensure ACK arrivedThe TIME-WAIT state ensures that any delayed packets from the old connection are discarded before the port can be reused. It typically lasts 60 seconds (2 * Maximum Segment Lifetime).
FIN closes a connection gracefully. RST aborts it immediately — no data in flight is delivered. You see RST when a connection is refused (no process listening on port) or when a process crashes.
TCP Connection States
Every TCP connection goes through a series of states. The most common ones you will see when debugging with ss or netstat.
# See all TCP connections and their states
ss -tan
# Count connections per state
ss -tan | awk '{print $1}' | sort | uniq -c | sort -rn
# Common states in the output
# ESTAB - Connection established, data flowing
# SYN-SENT - Client waiting for SYN-ACK
# SYN-RECV - Server received SYN, waiting for ACK
# TIME-WAIT- Connection closed, waiting for delayed packets
# CLOSE-WAIT - Remote end closed, local end hasn't yet
# FIN-WAIT-1 - Local end sent FIN, waiting for ACKCLOSE-WAIT is a red flag. It means the remote end closed but your process did not. This usually indicates a resource leak — the application is not calling close() on the socket.
TCP Tuning Parameters
Linux exposes TCP tuning through sysctl. These parameters matter for production systems handling many connections or high throughput.
# Increase the maximum number of connections
net.core.somaxconn = 4096
# Increase the backlog for incoming connections
net.ipv4.tcp_max_syn_backlog = 4096
# Reduce TIME-WAIT sockets for high-traffic servers
net.ipv4.tcp_tw_reuse = 1
# Increase the local port range
net.ipv4.ip_local_port_range = 1024 65535
# Enable TCP keepalive
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 3The tcp_tw_reuse setting allows reusing TIME-WAIT sockets for new outgoing connections. Never use tcp_tw_recycle — it breaks connections behind NAT and was removed in Linux 4.12.
Do not rely on tuning alone to handle connection pressure. Connection pooling reuses established TCP connections instead of creating new ones. This avoids the three-way handshake overhead and TIME-WAIT accumulation.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.