What is Three-way handshake?

The procedure that establishes a TCP connection. Three exchanges, the client's SYN, the server's SYN+ACK and the client's ACK, confirm each side's initial sequence number.

Japanese name: 3ウェイハンドシェイク

Three-way handshake appears in 2 practice questions across 1 topic, including Computer Networking Basics.

Field: Computer Networking Basics

What the three exchanges do

The client requests a connection with a SYN and announces its initial sequence number. The server replies with a SYN+ACK, acknowledging that number and announcing its own initial sequence number. When the client acknowledges this with an ACK, both directions have confirmed that "the other side knows my number," and data can flow. Confirming the numbers prevents mistaken connections caused by old packets lingering in the network.

Time to connect

At least one round-trip time (RTT) passes before data can be sent. HTTPS then needs a TLS handshake as well, so a request can be sent only after two round trips in total with TLS 1.3, or three with TLS 1.2. The farther the server, the larger the RTT, so the number of round trips is reduced by reusing connections (persistent connections) or by combining handshakes as QUIC does in HTTP/3.

Closing and SYN floods

Closing a connection usually takes four exchanges, because each direction is closed separately with a FIN and an ACK. An attack that sends large numbers of SYNs with forged source addresses, making the server hold half-open connections until its resources run out, is called a SYN flood. Countermeasures include SYN cookies, which let the server respond without keeping state.

Try it: questions about Three-way handshake

In the three-way handshake that establishes a TCP connection, what is the correct order of the packets exchanged?

  1. ASYN → ACK → FIN
  2. BACK → SYN → SYN+ACK
  3. CSYN → SYN+ACK → ACK
Show answer and explanation

Answer: C. SYN → SYN+ACK → ACK

In the three-way handshake, the client first requests a connection with a SYN and announces the first number of the data it will send (its initial sequence number). The server replies with a SYN+ACK, acknowledging (ACK) that and announcing its own initial sequence number. Finally the client returns an ACK, and both directions are ready. Confirming the numbers in both directions in three exchanges prevents mistaken connections, for example from old packets that arrive late. As a result, TCP needs at least one round-trip time (RTT) before data can start flowing. FIN is used to close a connection.

FAQ

Why are three exchanges needed instead of two?

Each side's initial sequence number must be confirmed as received by the other. With only two exchanges, the server could not confirm that its number reached the client.

Does UDP have a three-way handshake?

No. UDP does not establish connections, so it can send data immediately. QUIC, which runs on UDP, performs its own handshake combined with the cryptographic key exchange.

Three-way handshake in the explanations

Questions that mention Three-way handshake (2)

  1. In the three-way handshake that establishes a TCP connection, what is the correct order of the packets exchanged?
  2. A client makes a new HTTPS connection (TLS 1.3 over TCP) to a web server with a round-trip time (RTT) of 100 ms. Roughly how long does it take until the response to the first request starts to arrive? Assume DNS resolution is already done, and ignore server processing time and data transfer time.

Books on Computer Networking Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

TLS DNS (Domain Name System) HTTP (Hypertext Transfer Protocol) ARP CIDR CSMA/CA Default gateway DHCP MAC address NAT (Network Address Translation)

Back to the glossary