Understanding TCP Three-Way Handshake and Four-Way Termination for Interviews

In technical interviews, the TCP three‑way handshake and four‑way termination are among the most frequently asked topics; this article focuses on the essential points interviewers tend to probe and how to answer them comprehensively.

Three‑Way Handshake

When asked why the three‑way handshake is needed and what its purpose is, many candidates simply describe the three steps:

1. First step : the client sends a SYN packet to the server.

2. Second step : the server replies with a SYN‑ACK packet.

3. Third step : the client acknowledges with an ACK packet.

After the server receives the ACK, the connection is established.

The purpose is to confirm that both sides can send and receive data correctly.

Why three steps are necessary instead of two : First handshake confirms the client’s sending ability and the server’s receiving ability. Second handshake confirms the server’s sending ability and the client’s receiving ability, but the server still cannot be sure the client can receive. Third handshake confirms the client’s receiving ability and the server’s sending ability, completing the mutual verification.

Beyond the basic description, interviewers often expect a more detailed answer that includes the TCP state changes:

Initial states : client is in CLOSED , server is in LISTEN .

1. First handshake : client sends SYN with its Initial Sequence Number ISN(c) and moves to SYN_SENT state.

2. Second handshake : server receives SYN, replies with SYN‑ACK containing its own ISN(s) and acknowledges ISN(c)+1 , entering SYN_RECEIVED state.

3. Third handshake : client acknowledges with ACK, acknowledging ISN(s)+1 , and enters ESTABLISHED state.

4. Server receives the final ACK and also enters ESTABLISHED state, completing the connection.

Key functions of the three‑way handshake include:

Confirming both sides’ send/receive capabilities.

Exchanging ISNs to enable reliable data sequencing.

For HTTPS, performing certificate verification and key exchange.

Typical follow‑up interview questions:

Is the ISN fixed? No; a fixed ISN would be predictable and vulnerable to attacks, so ISNs are generated dynamically.

What is a half‑connection queue? After the server receives the SYN, it enters SYN_RECEIVED and places the request in the half‑connection (SYN) queue until the handshake completes; fully established connections go into the full‑connection queue.

Regarding SYN‑ACK retransmission: the server will retransmit the SYN‑ACK if the client’s ACK is not received, using exponential back‑off (e.g., 1 s, 2 s, 4 s, …) until the maximum retransmission limit is reached, after which the entry is removed from the half‑connection queue.

Can data be carried during the handshake? Data cannot be carried in the first two steps, but the third ACK can carry data because the connection is already established.

Four‑Way Termination

The termination process also requires a detailed description of each state transition:

Initially both sides are in ESTABLISHED . If the client initiates closure:

1. First FIN : client sends FIN with a sequence number and moves to CLOSE_WAIT_1 .

2. Second ACK : server acknowledges the FIN (ACK with seq+1 ) and enters CLOSE_WAIT_2 .

3. Third FIN : server sends its own FIN and moves to LAST_ACK .

4. Fourth ACK : client acknowledges the server’s FIN, entering TIME_WAIT to ensure the server receives the ACK; after a timeout the client moves to CLOSED .

5. Server receives the final ACK and transitions to CLOSED .

The TIME_WAIT state is a high‑frequency interview focus: the client must wait long enough to guarantee the server has received its ACK, allowing for possible retransmission of FIN if the ACK was lost.

TCP state definitions (for reference): LISTEN, SYN‑SENT, SYN‑RECEIVED, ESTABLISHED, FIN‑WAIT‑1, FIN‑WAIT‑2, CLOSE‑WAIT, CLOSING, LAST‑ACK, TIME‑WAIT, CLOSED.

Images illustrating the state diagrams for both the three‑way handshake and four‑way termination are provided in the original article.

Feel free to add any additional details or corrections in the comments.