Skip to content

# TCP Handshake Animator

Walk the TCP connection state machine one segment at a time: the three-way handshake (SYN, SYN-ACK, ACK), a graceful close (FIN/ACK through TIME-WAIT), a simultaneous close (crossing FINs through CLOSING), or an abrupt reset (RST). Each step shows the segment on the wire and the state of both endpoints: CLOSED, SYN-SENT, ESTABLISHED, and the rest.

Rendered when the site was built, by the same state machine the browser runs. No JavaScript required. With JavaScript on, this is replaced by the interactive ladder, which reveals one segment at a time.

## The 11 states

Every RFC 793 connection state, in the order the machine walks them: `CLOSED · LISTEN · SYN-SENT · SYN-RECEIVED · ESTABLISHED · FIN-WAIT-1 · FIN-WAIT-2 · CLOSE-WAIT · CLOSING · LAST-ACK · TIME-WAIT`. A connection is only ever in one of them at each end, and the traces below name both ends at every step.

- ### TCP Three-Way Handshake

  3 segments, 4 steps.

      · (initial) · client=CLOSED server=LISTEN
      step 1/3 · C->S SYN seq=100 ack=0 len=0 · client=SYN-SENT server=LISTEN
      step 2/3 · S->C SYN,ACK seq=500 ack=101 len=0 · client=SYN-SENT server=SYN-RECEIVED
      step 3/3 · C->S ACK seq=101 ack=501 len=0 · client=ESTABLISHED server=ESTABLISHED

  TCP Three-Way Handshake: step by step
  Step | Segment | Client | Server | What happened
  --- | --- | --- | --- | ---
  1 | none | CLOSED | LISTEN | Client is CLOSED; the server is LISTENing for connections.
  2 | SYN | SYN-SENT | LISTEN | Client sends a SYN with its initial sequence number (ISN=100) and enters SYN-SENT.
  3 | SYN,ACK | SYN-SENT | SYN-RECEIVED | Server acknowledges the SYN (ack=101) and sends its own SYN (ISN=500), entering SYN-RECEIVED.
  4 | ACK | ESTABLISHED | ESTABLISHED | Client acknowledges the server's SYN (ack=501); the handshake is complete and both ends are ESTABLISHED.

- ### Graceful Connection Teardown

  4 segments, 6 steps.

      · (initial) · client=ESTABLISHED server=ESTABLISHED
      step 1/4 · C->S FIN,ACK seq=200 ack=800 len=0 · client=FIN-WAIT-1 server=ESTABLISHED
      step 2/4 · S->C ACK seq=800 ack=201 len=0 · client=FIN-WAIT-2 server=CLOSE-WAIT
      step 3/4 · S->C FIN,ACK seq=800 ack=201 len=0 · client=FIN-WAIT-2 server=LAST-ACK
      step 4/4 · C->S ACK seq=201 ack=801 len=0 · client=TIME-WAIT server=CLOSED
      · (initial) · client=CLOSED server=CLOSED

  Graceful Connection Teardown: step by step
  Step | Segment | Client | Server | What happened
  --- | --- | --- | --- | ---
  1 | none | ESTABLISHED | ESTABLISHED | The connection is open; both ends are ESTABLISHED.
  2 | FIN,ACK | FIN-WAIT-1 | ESTABLISHED | Client begins an active close, sending FIN and entering FIN-WAIT-1.
  3 | ACK | FIN-WAIT-2 | CLOSE-WAIT | Server acknowledges the FIN (ack=201): the client enters FIN-WAIT-2 and the server enters CLOSE-WAIT.
  4 | FIN,ACK | FIN-WAIT-2 | LAST-ACK | Server finishes sending and closes, emitting its own FIN and entering LAST-ACK.
  5 | ACK | TIME-WAIT | CLOSED | Client acknowledges the server's FIN (ack=801): the server reaches CLOSED and the client enters TIME-WAIT.
  6 | none | CLOSED | CLOSED | TIME-WAIT lasts 2·MSL so any straggling segments drain before the client finally reaches CLOSED.

- ### Simultaneous Close (Crossing FINs)

  4 segments, 6 steps.

      · (initial) · client=ESTABLISHED server=ESTABLISHED
      step 1/4 · C->S FIN,ACK seq=200 ack=800 len=0 · client=FIN-WAIT-1 server=ESTABLISHED
      step 2/4 · S->C FIN,ACK seq=800 ack=200 len=0 · client=FIN-WAIT-1 server=FIN-WAIT-1
      step 3/4 · C->S ACK seq=201 ack=801 len=0 · client=CLOSING server=CLOSING
      step 4/4 · S->C ACK seq=801 ack=201 len=0 · client=TIME-WAIT server=TIME-WAIT
      · (initial) · client=CLOSED server=CLOSED

  Simultaneous Close (Crossing FINs): step by step
  Step | Segment | Client | Server | What happened
  --- | --- | --- | --- | ---
  1 | none | ESTABLISHED | ESTABLISHED | The connection is open; both ends are ESTABLISHED.
  2 | FIN,ACK | FIN-WAIT-1 | ESTABLISHED | Client closes, sending FIN and entering FIN-WAIT-1, but this FIN is still in flight.
  3 | FIN,ACK | FIN-WAIT-1 | FIN-WAIT-1 | Server closes at the same moment, before the client's FIN arrives (ack=200 proves it has not seen it). The two FINs cross on the wire and both ends sit in FIN-WAIT-1.
  4 | ACK | CLOSING | CLOSING | The crossed FINs land: each end receives its peer's FIN while still awaiting an ACK for its own, so both enter CLOSING, the simultaneous-close state. The client acknowledges the server's FIN (ack=801).
  5 | ACK | TIME-WAIT | TIME-WAIT | Server acknowledges the client's FIN (ack=201); as the two ACKs land, CLOSING gives way to TIME-WAIT on both ends: in a simultaneous close, neither side gets to skip it.
  6 | none | CLOSED | CLOSED | Both ends closed actively, so both hold TIME-WAIT for 2·MSL while stray segments drain, then reach CLOSED.

- ### Connection Reset (RST)

  1 segment, 2 steps.

      · (initial) · client=ESTABLISHED server=ESTABLISHED
      step 1/1 · C->S RST seq=200 ack=0 len=0 · client=CLOSED server=CLOSED

  Connection Reset (RST): step by step
  Step | Segment | Client | Server | What happened
  --- | --- | --- | --- | ---
  1 | none | ESTABLISHED | ESTABLISHED | The connection is open; both ends are ESTABLISHED.
  2 | RST | CLOSED | CLOSED | Client sends RST, tearing the connection down immediately: no handshake, both ends drop to CLOSED.

Either side of this state machine has a tool of its own: the Packet Analyzer takes a real captured segment apart down to its flags and sequence numbers, and the Local HTTP Request Constructor builds the request that rides on the connection once it is open.

About this lab3 paragraphs

Four scenarios cover the connection's whole life: the open, the orderly close, the close where both ends hang up at once, and the abort. Each is a fixed trace rather than a live socket, so stepping backwards is free and the same segment always carries the same numbers.

What it leaves out is everything that makes TCP hard in practice. There is no loss, no retransmission, no window arithmetic, no delayed acknowledgement and no simultaneous open (the mirror image of the simultaneous close, with crossing SYNs). Those belong to the congestion story; this is the state machine.

TIME-WAIT is the one place the animation is worth reading twice. It is the state that looks like a bug and is not: the endpoint that closed first holds on so a late duplicate cannot land on a new connection reusing the same pair of ports. In the simultaneous close both ends closed actively, so both pay it, and CLOSING (the state between the crossed FINs and their acknowledgments) appears in that trace and nowhere else.