Every reliable connection on the internet begins with a three-way handshake and ends with a graceful four-way teardown. Watch the packets flow, inspect the flags, and follow the state transitions in real time.
TCP establishes connections using SYN, SYN-ACK, and ACK. The client sends a synchronize request with an initial sequence number, the server acknowledges and sends its own, then the client confirms.
Every byte in a TCP stream is numbered. The SEQ field marks the first byte being sent, and ACK confirms the next byte expected from the other side. This ensures ordered, reliable delivery.
TCP endpoints track connection state: CLOSED → SYN_SENT → ESTABLISHED on the client side, LISTEN → SYN_RCVD → ESTABLISHED on the server. Each transition is triggered by a specific packet.
Closing requires four packets: each side sends FIN independently and receives ACK. This allows half-close — one side can stop sending while still receiving data.
SYN initiates a connection. ACK acknowledges received data. FIN signals the sender is done. RST aborts immediately. Flags are bit fields in the TCP header — a single packet can carry multiple flags.
Every HTTP request, database query, and API call travels over a TCP connection. Understanding the handshake explains latency (1 extra RTT before data flows), connection pooling, and why TIME_WAIT exists.