What you’ll be able to do
- Trace SYN, SYN-ACK, and ACK and name why the listening end waits for the third packet before ESTABLISHED.
- Explain that ESTABLISHED is agreed next-byte numbering, not encryption and not human authentication.
- Separate a listening port (reachability) from a safety or authorization verdict.
Why three, not one
A client that wants a reliable byte stream cannot treat the first SYN as an open road. The listening end has not yet shared its own starting number, and nothing has proved the client heard that number. RFC 9293 calls the exchange a three-way handshake: SYN, then SYN-ACK, then ACK.
Watch the figure. SYN carries the client’s starting number. SYN-ACK acknowledges it and carries the server’s. ACK acknowledges the server’s number. Only then are both ends ESTABLISHED. The counters 100 and 500 in the figure are a teaching model, not a claim about every stack’s initial sequence number.
WATCH THE HANDSHAKE
Three packets. Then connected.
Watch who sends each packet and why the server waits for the final ACK.
The client is CLOSED. The server is LISTENing. No packet has crossed the wire.
Chapter 1 of 5
Read the whole path as a list
Plays once when the picture comes into view, then stops. Play resumes; Replay starts over. Scrub or choose a chapter to pause and inspect. Leaving the picture or hiding the tab pauses playback. Reduced motion shows still chapters with no travel.
- The client is CLOSED. The server is LISTENing. No packet has crossed the wire.Client is CLOSED and Server is LISTEN. Counters show a dash until their starting numbers are used in this illustration.
- The client sends SYN seq=100, its starting number. The SYN uses up 100, so the next byte it sends will be 101.A SYN segment, seq=100, is on the wire from Client to Server. Client is SYN_SENT with seq 101 and no ack yet. Server is still LISTEN.
- The server replies SYN-ACK. ack=101 means “got your 100, send 101 next.” seq=500 is the server’s own start.A SYN-ACK segment, seq=500 ack=101, is on the wire from Server to Client. Server is SYN_RCVD with seq 501, ack 101. Client is still SYN_SENT.
- The client is ESTABLISHED and sends ACK ack=501: “got your 500.” The server stays SYN_RCVD until it lands.An ACK segment, seq=101 ack=501, is on the wire from Client to Server. Client is ESTABLISHED with seq 101, ack 501. Server is still SYN_RCVD.
- The ACK lands, so the server is ESTABLISHED too. Each end expects exactly what the other sends next. Data can flow.The wire is open and empty. Both ends are ESTABLISHED. Client seq 101 matches Server ack 101, and Server seq 501 matches Client ack 501.
Read this as a table
Three segments open a TCP connection. SYN carries the client’s starting number. SYN-ACK acknowledges it and carries the server’s. ACK acknowledges that. Afterwards each end’s seq, the next byte it sends, equals the other end’s ack, the next byte it expects.
| Beat | On the wire | Client | Server |
|---|---|---|---|
| 1. Closed | Nothing | CLOSED; seq -, ack - | LISTEN; seq -, ack - |
| 2. SYN | Client to Server: SYN seq=100 | SYN_SENT; seq 101, ack - | LISTEN; seq -, ack - |
| 3. SYN-ACK | Server to Client: SYN-ACK seq=500 ack=101 | SYN_SENT; seq 101, ack - | SYN_RCVD; seq 501, ack 101 |
| 4. ACK | Client to Server: ACK seq=101 ack=501 | ESTABLISHED; seq 101, ack 501 | SYN_RCVD; seq 501, ack 101 |
| 5. Established | Nothing; data can flow | ESTABLISHED; seq 101, ack 501 | ESTABLISHED; seq 501, ack 101 |
Scene checked 2026-09-27.
CHECK THE PICTURE
Maya’s capture from the customer’s phone shows SYN seq=100, then SYN-ACK seq=500 ack=101, then ACK seq=101 ack=501. Why does the server wait for that third packet before it counts the connection as ESTABLISHED?
What ESTABLISHED means
ESTABLISHED means both ends agree on the next byte each will send and the next byte each expects. Packets can carry application data on that numbered road. TCP’s job here is reliable, ordered delivery of a byte stream between two ports on two addresses.
ESTABLISHED does not encrypt. Confidentiality and integrity of application bytes are TLS’s job (see Public values travel. The session secret does not.). Who sits at the phone and whether shipment 8821 is allowed are application decisions after the road opens. A listening port is evidence of a reachable service, not a safety verdict (see the port glossary).
After the road opens
On the Riverstone cast, the customer’s phone still needs a TLS session to TrackPort and an HTTP request for shipment 8821. Name, DNS, certificate name-match, and cookies live on the Networks lesson’s relay-race figure. Public values versus a locally derived session secret live on Public values travel. The session secret does not.
Come back here when a capture only shows SYN / SYN-ACK / ACK and someone claims the connection was “secure” or “logged in.” Reachability came first. Encryption and identity are separate checks.
CHECK YOUR JUDGMENT