TCP/IP Explained

Demystifying SYN, SYN-ACK, and ACK

How RFC 793 forces order and guaranteed delivery over the chaotic, stateless internet.

The "syn, syn-ack, ack" process describes the Transmission Control Protocol (TCP) three-way handshake, which is the foundational method used by networked devices to establish a reliable connection before transmitting data.

At its lowest level, the physical infrastructure of the internet offers absolutely no guarantees. When a router transmits a packet of data across a fiber optic cable, it simply fires the packet into the void. Cables get cut, routers drop packets when overloaded, and data often arrives out of order. This base layer is known as the Internet Protocol (IP), and it is entirely stateless.

The Internet Protocol (IP) is the primary set of rules governing how data is formatted, sent, and received across the internet and other computer networks. It acts as a digital postal system, routing data packets from a source device to their exact destination using unique numeric identifiers called IP addresses.

If an application needs to send a 5GB database backup, it cannot rely on IP alone. If chunk #482 is dropped in transit, the entire file is corrupted, and the receiving server has no way of knowing it missed a piece.

The Transmission Control Protocol (TCP) is a foundational networking standard that ensures the reliable, ordered, and error-checked delivery of data between applications across IP networks. Operating at the Transport Layer (Layer 4) of the OSI model, it guarantees that no data is lost or corrupted.

To solve this, engineers rely on the Transmission Control Protocol (TCP), formally defined in RFC 793. TCP operates directly on top of IP, creating a temporary, stateful connection that guarantees perfect data delivery. Before a single byte of application data is sent, TCP forces the two machines to negotiate the rules of engagement. This negotiation is the 3-Way Handshake.

RFC 793 defines the Transmission Control Protocol (TCP), the core IETF standard that ensures reliable, ordered, and error-checked delivery of data between applications across computer networks. It establishes connection-oriented communication using a three-way handshake, manages data flow through sequence numbers and acknowledgments, prevents buffer overflows using sliding window flow control, and uses timeouts and retransmissions to recover from packet loss.

The Foundation: Sequence Numbers

The magic of TCP relies entirely on tracking sequence numbers.

When a computer sends data over TCP, it does not just send raw bytes. It assigns a specific numerical sequence to every single byte. If the receiver gets bytes 1 through 100, and then receives bytes 201 through 300, it mathematically knows that bytes 101 through 200 were lost in transit. The receiver will halt the process and demand the sender retransmit the missing data.

TCP sequence numbers are 32-bit numbers that track the position of data bytes in a transmission. They ensure that data packets arrive in the correct order. The three-way handshake uses Initial Sequence Numbers (ISNs) generated by both the client and server to begin communication.

However, a connection cannot just start at sequence number 1. This would make the connection highly vulnerable to network attacks (like TCP spoofing) and confusion from delayed packets belonging to old, closed connections.

Note: TCP spoofing is an attack where an unauthorized user impersonates a trusted IP address to establish a Transmission Control Protocol (TCP) connection. By forging the source IP, attackers can bypass critical security checks such as firewalls, IP-based authentication, and email allowlists like SPF records.

Instead, both the client and the server must independently generate a completely random Initial Sequence Number (ISN). The entire purpose of the 3-Way Handshake is for the two machines to exchange and acknowledge these random starting numbers before the real data starts flowing.

Step 1: SYN (Synchronize)

SYN, ACK, and SYN-ACK are the three network packets exchanged during a TCP three-way handshake to establish a secure, reliable connection between a client and a server.

The process begins when a client (like your web browser) wants to talk to a server.

The client generates its random ISN—for example, 5000. It creates an empty TCP packet, sets a specific binary flag in the packet header called SYN (Synchronize), and sends it to the server.

This packet translates to: “I want to establish a secure connection with you, and my data stream is going to start at sequence number 5000.”