TCP is a connection-oriented protocol. But wires don't have "connections": they just have electricity, or photons of light, flying over fiber-optic cables. A connection is entirely a shared hallucination between two operating systems.
To establish this hallucination, the two machines must agree on their starting states. They do this by exchanging packets with specific control flags set: the SYN (synchronize) and ACK (acknowledge) flags. This is the famous 3-way handshake.
The 3-Way Handshake
When you type a URL into your browser, before a single byte of HTTP data is sent, the operating system kernel performs this ritual:
Client sends SYN: "I want to connect, and my sequence numbers will start at X."
Server replies SYN-ACK: "I acknowledge your X (I expect X+1 next). I also want to connect, and my sequence numbers will start at Y."
Client sends ACK: "I acknowledge your Y (I expect Y+1 next)."
State Machine Simulator
Watch the kernel state transitions. Click the buttons to advance the handshake, and later, the teardown.
Once the handshake completes, both kernels mark the socket state as ESTABLISHED. From this point on, every packet sent will have the ACK flag set, acknowledging the last data received. The initial SYN is the only packet sent by the client that does not have an ACK flag.
Teardown: The 4-Way FIN
When the application calls close(), the kernel doesn't just sever the connection immediately. It initiates a graceful shutdown using the FIN (finish) flag. Because TCP is full-duplex (data flows both ways independently), each side must close its own half of the connection.
Try clicking the Close (FIN) button in the lab above. You will see:
Client sends FIN: "I have no more data to send." (Client enters FIN_WAIT_1)
Server ACKs FIN: "Understood." (Server enters CLOSE_WAIT)
Server sends FIN: "I also have no more data to send." (Server enters LAST_ACK)
The TIME_WAIT State: Notice how the client doesn't immediately go back to CLOSED. It sits in TIME_WAIT for typically 2 minutes (2x Maximum Segment Lifetime). Why? Because its final ACK might have been dropped by the network! If it closed immediately and the server retransmitted its FIN, the client would reply with an error (RST). TIME_WAIT ensures the connection is fully drained from the network.
Abrupt Teardown: RST
Sometimes you don't have the luxury of a graceful 4-way close. If a server process crashes, or you receive a packet for a connection that you have no memory of, the kernel sends a RST (reset) packet.
A RST packet tells the receiver: "Abort immediately. Delete your connection state. Do not send me any more packets, and do not expect an ACK for this." Try clicking the Abort (RST) button after establishing a connection in the lab to see it instantly nuke the state on both sides.
Check yourself
1. Why does the client wait in the TIME_WAIT state instead of closing immediately after sending the final ACK?
If the final ACK drops, the server will retransmit its FIN. If the client had already deleted its connection state, it would reply to the FIN with a RST, causing the server to register an error instead of a graceful close.
2. During the 3-way handshake, what is the significance of the SYN packet sent by the client?
The primary purpose of the SYN (synchronize) packet is to synchronize sequence numbers between the two machines, allowing them to accurately track bytes sent and received.