---
title: "TCP connection establishment"
subject: "Computer Networks and Security"
chapter: 5
key: "semester_7/computer_networks_and_security:tcp-connection-establishment"
source: https://www.bctengineer.com/q/semester_7/computer_networks_and_security/tcp-connection-establishment
site: BCT Engineering
---

# TCP connection establishment

Computer Networks and Security · Chapter 5: Transport Layer

- Asked in: 2071 Shrawan, 5 marks
- Video: [TCP Connection Establishment || Three Way Handshake || Transport layer || Computer Networks](https://www.youtube.com/watch?v=WqV0TRTvvqA) — Sudhakar Atchala
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_7/computer_networks_and_security/tcp-connection-establishment
- Whole chapter: https://www.bctengineer.com/md/semester_7/computer_networks_and_security/chapter-5

## Question

How is a TCP connection established? Explain.

## Short answer

TCP establishes a connection via a three-way handshake: client sends SYN with its initial sequence number (ISN), server responds with SYN+ACK carrying its ISN and ack=ISN+1, client then sends ACK acknowledging the server's ISN+1. This synchronises sequence numbers and confirms readiness.

## Answer

TCP establishes a connection by the **three-way handshake**, which synchronises the sequence numbers of both sides and confirms that both are ready. The server must first do a passive open (`listen`), then the client does an active open (`connect`).

```text
  Client                                Server
  CLOSED                                LISTEN
    |--- SYN, seq=1000 ------------------>|  SYN_RCVD
  SYN_SENT                                 |
    |<-- SYN+ACK, seq=5000, ack=1001 ------|
    |--- ACK, seq=1001, ack=5001 --------->|
  ESTABLISHED                         ESTABLISHED
```

#### Steps (with example numbers)
1. **SYN:** the client chooses an initial sequence number (ISN), say 1000, and sends a segment with SYN = 1. A SYN consumes one sequence number.
2. **SYN + ACK:** the server chooses its own ISN (5000), sets SYN = 1 and ACK = 1, with ack number = 1000 + 1 = 1001. It also announces its window size and MSS.
3. **ACK:** the client sends ACK = 1 with ack number 5000 + 1 = 5001. This segment can already carry data. The connection is now ESTABLISHED.

#### Why three steps?
- Two steps would not let the server know the client received its ISN.
- Random ISNs prevent old duplicate segments from being accepted by a new connection.

#### Notes
- If the SYN is lost, the client retransmits after a timeout.
- A SYN flood attack sends many SYNs without the final ACK to fill the server's half-open connection queue; SYN cookies are a defence.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What does the three-way handshake mainly achieve?
   A. Encrypts the connection
   B. Synchronises sequence numbers and confirms both sides are ready
   C. Assigns an IP address to the client
   D. Measures the network bandwidth
   Answer: B. It synchronises the initial sequence numbers of both sides and confirms readiness. (Key point: Purpose of handshake)

2. The client sends SYN with seq=1000. What ack number does the server's SYN+ACK carry?
   A. 1000
   B. 1001
   C. 5000
   D. 5001
   Answer: B. A SYN consumes one sequence number, so the server acknowledges 1000 + 1 = 1001. (Key point: Ack numbers)

3. Why are two steps not enough to establish a connection?
   A. The server would not know the client received its ISN
   B. The client would not know its own port
   C. DNS would not be consulted
   D. The window size could not be sent
   Answer: A. The third ACK confirms to the server that the client received the server's ISN. (Key point: Why three steps)

4. How does a SYN flood attack harm a server?
   A. It sends many SYNs without the final ACK, filling the half-open queue
   B. It sends FIN segments to close connections
   C. It guesses ISNs to hijack sessions
   D. It floods the server with ACKs only
   Answer: A. Unfinished handshakes fill the half-open connection queue; SYN cookies defend against it. (Key point: SYN flood)

## Related in Computer Networks and Security

- [TCP connection establishment and release](https://www.bctengineer.com/question.md?key=semester_7%2Fcomputer_networks_and_security%3Atcp-establish-release) — Computer Networks and Security, chapter 5
- [TCP connection and graceful termination](https://www.bctengineer.com/question.md?key=semester_7%2Fcomputer_networks_and_security%3Atcp-connection-termination) — Computer Networks and Security, chapter 5