How every TCP connection begins: the three-way handshake. Three packets that you will recognise on sight in a capture, and that underlie a whole class of attacks.
The TCP Handshake
In brief
Objectives
- Recite the SYN / SYN-ACK / ACK sequence
- Recognise the handshake in a packet capture
- Explain what a half-open connection signals
Before TCP sends any real data, the two machines perform a three-way handshake to agree that both can send and receive. It is three small packets, and understanding it explains a huge amount of what you will see in a packet capture.
The three steps
The client sends a SYN ("I want to talk, here is my starting sequence number"). The server replies SYN-ACK ("understood, and here is mine"). The client sends a final ACK, and the connection is established. Only now does data flow.
$ sudo tcpdump -n -i any "tcp port 80 and host example.com"
IP 10.0.0.5.51514 > 93.184.216.34.80: Flags [S] seq 1069
IP 93.184.216.34.80 > 10.0.0.5.51514: Flags [S.] seq 4200, ack 1070
IP 10.0.0.5.51514 > 93.184.216.34.80: Flags [.] ack 4201
Tip
A half-open connection — a SYN with no matching ACK — is the signature of a port scan or a SYN flood. You have just learned to recognise one.
Recap
- TCP opens with SYN, SYN-ACK, ACK
- Data flows only after the handshake completes
- A SYN with no ACK is the mark of a scan or flood