RobotnixAcademy

Week 18 · lesson

TCP Three-Way Handshake: Establish the Conversation

TCP provides a connection-oriented transport service.

Before application data is exchanged, two endpoints normally establish state using a three-way handshake:

SYN -> SYN/ACK -> ACK

Step 1: SYN

The client sends a TCP packet with SYN set.

Conceptually:

"I want to start a TCP conversation."

Step 2: SYN/ACK

The server responds with SYN and ACK set.

Conceptually:

"I received your request and I am ready from my side."

Step 3: ACK

The client acknowledges the server response.

After the handshake, application data can flow according to the connection state.

Use the actual GSC packet evidence

Open:

gsc-week17-baseline.pcapng

The supplied endpoints are:

Client: 192.0.2.25:51515
Server: 192.0.2.10:80

Use:

tcp

Find one complete handshake and record:

  • SYN packet number
  • SYN/ACK packet number
  • ACK packet number
  • client IP/port
  • server IP/port
  • timestamps
  • first application-data packet after the handshake

Sequence matters

If you see only one SYN, you cannot claim a complete TCP connection was established.

A complete sequence needs evidence for the state transition, not just one packet.

Ports and services

A destination port can suggest an intended transport endpoint, but a port number alone is not proof of a particular human, application, or intent.

Use the application/protocol evidence in the supplied capture when available.

In the GSC capture, Wireshark should also expose HTTP-layer evidence after the handshake. Cite what is actually visible rather than inferring more than the capture contains.

Local capture versus routed-path model

The .pcapng records a local synthetic conversation between 192.0.2.25 and 192.0.2.10.

Separately, the Week 18 topology model teaches this routed concept:

  1. workstation determines a destination is not local
  2. workstation sends a local frame to its next hop
  3. a router forwards the IP packet between networks
  4. additional routers may forward toward the destination network
  5. transport state is tracked by the endpoint IP/port conversation in our simplified model

ARP helps resolve a local destination or next hop. Routing moves IP packets between networks. TCP establishes transport state.

Do not claim that the local GSC capture proves the routed steps in the simulator.

Build a handshake timeline

Create:

PacketDirectionFlagsMeaningEvidence field

Fill in:

  • SYN
  • SYN/ACK
  • ACK
  • first application-data packet

Failure case

Your teacher provides a separate synthetic trace:

SYN
SYN
SYN

with no reply.

Write:

  • what you observe
  • what the trace supports
  • three possible explanations
  • one additional piece of evidence needed to distinguish the possibilities

Do not label that trace a denial-of-service attack. That topic belongs to Cybersecurity II and is not established by the evidence.

Evidence for Lesson 2

Submit:

  • complete handshake timeline
  • endpoint map
  • one routed-path concept diagram
  • failed-handshake analysis
  • one sentence separating what the packet capture proves from what the topology model predicts

Finish with:

A complete TCP connection is supported by the capture when ________.

The three-way handshake teaches a larger lesson: network state is built from a sequence of packets, so one packet rarely tells the whole story.