The TCP (Transmission Control Protocol) handshake — also called the three-way handshake — is the process used to establish a reliable connection between a client and a server before any data is sent. It ensures both sides are ready to communicate and agree on parameters like sequence numbers.

The Three Steps

  1. SYN — The client sends a SYN (synchronize) packet to the server, indicating it wants to establish a connection and sharing its initial sequence number.
  2. SYN-ACK — The server responds with a SYN-ACK (synchronize-acknowledge) packet, acknowledging the client's SYN and sharing its own sequence number.
  3. ACK — The client sends an ACK (acknowledge) packet confirming receipt of the server's SYN-ACK. The connection is now established.

Why This Matters for Performance

Every TCP connection requires this handshake before a single byte of application data can be sent. For HTTPS, a TLS handshake then occurs on top, adding further round trips. This is why connection overhead matters for web performance:

  • HTTP/1.1 opens a new TCP connection per request (or uses persistent connections with limits)
  • HTTP/2 multiplexes multiple requests over one connection — one handshake for many requests
  • HTTP/3 (QUIC) uses UDP and combines the transport and crypto handshake, reducing connection setup to one round trip

TCP Handshake and Security: SYN Flood Attacks

A SYN flood is a DDoS attack that exploits the handshake. The attacker sends thousands of SYN packets with spoofed source IPs. The server sends SYN-ACK replies and waits for the final ACK — which never comes. The server's connection table fills up, preventing legitimate connections. SYN cookies are a common mitigation that avoids storing per-connection state during the handshake.

People Also Ask

What happens after the TCP handshake?
After the three-way handshake, data transfer begins. For HTTPS, a TLS handshake occurs next (adding 1–2 more round trips) to negotiate encryption keys. Once TLS is established, encrypted application data (HTTP requests and responses) flows over the connection.
How long does a TCP handshake take?
The handshake takes one round trip — the time for a packet to travel from client to server and back. On a local network this is under 1ms. Across a continent it may be 50–150ms. Across the globe it can be 200–400ms, which is why CDNs that reduce physical distance significantly improve performance.

Related: Latency | CDN | HTTPS