The TCP (Transmission Control Protocol) three-way handshake is a method used to establish a connection between a client and a server. It is termed a “three-way” handshake because there are three steps or messages exchanged between the two parties. Here’s a breakdown:
- SYN: The client initiates the connection by sending a TCP packet with the SYN (synchronize) flag set to the server. This indicates that the client wishes to establish a connection. The packet also contains an initial sequence number, which will be used to track the sequence of all subsequent packets.
- SYN-ACK: Upon receiving the client’s SYN packet, the server responds with a TCP packet of its own with both the SYN and ACK (acknowledge) flags set. The acknowledgment number in this packet is one more than the initial sequence number received from the client. The server also provides its own initial sequence number.
- ACK: Finally, the client sends back an ACK packet to acknowledge receipt of the server’s SYN-ACK. The acknowledgment number in this packet is one more than the initial sequence number received from the server. After this packet is sent, the connection is considered established, and data transfer can begin.
Significance of the TCP Three-Way Handshake:
- ReliabilityThe handshake ensures that both the client and server are ready to transmit and receive data, ensuring a reliable connection setup.
- SequencingBy exchanging initial sequence numbers, both the client and server can track the order of packets, ensuring data is processed in the correct order.
- Flow ControlThis mechanism helps establish initial parameters for flow control, which will ensure efficient and orderly communication between the two parties.
- Security ImplicationsWhile the three-way handshake establishes a connection reliably, it is not without its vulnerabilities. For instance, it can be exploited in attacks like the SYN flood, where attackers inundate a server with SYN requests without completing the handshake, consuming resources and potentially causing a denial of service.
Key terms in plain language
Open a term for a concise explanation of language used on this page.
Cybersecurity
The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.
Zero Trust
A security model that does not automatically trust a user or device because of its location. Access is continuously verified and limited to what is necessary.
SASE
Secure Access Service Edge combines networking and security capabilities in a cloud-delivered architecture so users and locations can receive consistent policy wherever they connect.
Identity and Access Management (IAM)
The systems and policies that determine who a user is, what resources they may access, and how that access is authenticated and reviewed.
Multi-Factor Authentication (MFA)
A login control requiring more than one form of verification, such as a password plus an authenticator app, security key, or biometric factor.
MDR / XDR
Security services and tools that monitor activity, investigate suspicious behavior, and help contain threats. MDR is managed detection and response; XDR correlates signals across multiple security layers.