3. OSI Model, TCP/IP Model, TCP vs UDP and the 3-Way Handshake
3.5 The TCP 3-Way Handshake, TCP Flags and Connection Close
Ha chapter cha sagalyat important topic – dhyan dya. TCP connection suru honyapurvi don machines "hello" boltat. He teen steps lakshat theva – Nmap che scan types, SYN flood attack, firewall states, Wireshark madhli analysis – sagla ya handshake var aadharit aahe.
Client (192.168.56.10:51544) Server (192.168.56.101:80)
| 1. SYN seq=1000 |
| ---------------------------------------------> | "I want to talk"
| 2. SYN-ACK seq=5000, ack=1001 |
| <--------------------------------------------- | "OK, I heard you"
| 3. ACK seq=1001, ack=5001 |
| ---------------------------------------------> | connection ESTABLISHED
| ... data (PSH/ACK) both ways ... |
| FIN ---------------------------------------> | 4-way close:
| <--------------------------------------- ACK | FIN, ACK, FIN, ACK
| <--------------------------------------- FIN |
| ACK ---------------------------------------> |
| Flag | Meaning | Where you meet it |
|---|---|---|
| SYN | Synchronise – start a connection | Handshake step 1 and 2, SYN scan (nmap -sS) |
| ACK | Acknowledge received data | Every packet after the first |
| FIN | Finish – graceful close ("I have finished sending") | Connection close, FIN scan |
| RST | Reset – abort immediately | Reply from a closed port |
| PSH | Push data to the application now | Interactive traffic |
| URG | Urgent pointer valid | Rare; Xmas scan sets FIN+PSH+URG |
How ports answer a SYN (this is how Nmap decides):
| Probe | Server replies | Nmap says |
|---|---|---|
| SYN | SYN-ACK | open |
| SYN | RST | closed (host is up) |
| SYN | Nothing / ICMP unreachable | filtered (a firewall or security group dropped it) |
sudo tcpdump -i any -nn 'tcp port 80 and (tcp[tcpflags] & (tcp-syn|tcp-fin|tcp-rst) != 0)'
# in another terminal: curl -s http://localhost > /dev/null -> watch SYN, SYN-ACK, FIN
Why this matters for security
A SYN flood sends thousands of SYNs and never completes step 3, filling the server's half-open connection table; defences are SYN cookies, rate limits and cloud DDoS protection such as AWS Shield. A SYN (half-open) scan sends SYN, reads the reply and sends RST instead of ACK – that is nmap -sS, the default scan when run as root. Filtered vs closed also tells an attacker whether a firewall is present.
Ravindra Bagale's Tip
Handshake sangtana khup students "SYN, ACK, SYN-ACK" asa ulta kram boltat. Barobar kram: SYN → SYN-ACK → ACK, aani ack = received seq + 1 – ACK mhanje "pudhcha byte mala hava". Aani closed port la "no reply" mhanu naka – closed port RST pathavto; "no reply" mhanje filtered. He sangitla ki interviewer la kalte tumhi fakt ratla nahi.
Practice task
Run the tcpdump command above on a lab machine with a web server, then open the page with curl. Identify the SYN, SYN-ACK and ACK lines and the FIN/RST at the end.