TCP Explained: Handshake, Sequence Numbers, Retransmission and the SYN Flood Attack
TCP (Transmission Control Protocol) turns the internet's unreliable, best-effort packet delivery into a reliable stream of bytes. It does this with three ideas: a 3-way handshake to start, sequence numbers and ACKs to track every byte, and retransmission to fix anything that gets lost. The interactive lesson above shows each one packet by packet, then shows how attackers abuse the handshake.
1. The 3-way handshake (SYN, SYN-ACK, ACK)
- SYN: the client sends its starting sequence number.
- SYN-ACK: the server acknowledges it (client's number + 1) and sends its own starting number.
- ACK: the client acknowledges the server's number + 1. Both sides are now ESTABLISHED.
Wireshark shows relative sequence numbers starting at 0, as in the lesson. Real starting numbers are random 32-bit values, which makes connections harder to hijack.
2. Every byte is numbered
If the client sends 78 bytes starting at seq 1, the server replies ack=79: "I have bytes 1–78, send 79 next." The ACK number always means "the next byte I expect".
3. Packet loss and retransmission
When a segment is lost, the receiver keeps acknowledging the last byte it got in order (a duplicate ACK). The sender notices and resends only the missing segment. In Wireshark these show as [TCP Dup ACK] and [TCP Retransmission].
4. Closing the connection
Each side sends a FIN when it's done sending, and the other side acknowledges it: FIN → FIN-ACK → ACK.
5. SYN flood attack
After a SYN, the server reserves a slot in its half-open queue while it waits for the final ACK. A SYN flood sends huge numbers of SYNs from spoofed IP addresses. The ACKs never come, the queue fills, and real users can't connect (Denial of Service). Spot it with:
tcp.flags.syn==1 && tcp.flags.ack==0
6. Defence: SYN cookies
With SYN cookies the server stores nothing after a SYN. It encodes the connection details in its own sequence number and only creates the connection when a valid ACK (cookie + 1) returns. On Linux: net.ipv4.tcp_syncookies = 1. Rate limiting and upstream DDoS protection help against large floods.
Practise this in a real lab
Capture a live handshake in Wireshark, watch a retransmission happen, run an Nmap SYN scan and defend a server against a SYN flood, all inside ER Segment's private hacking labs.
Explore ER Segment training →FAQ
Why does the ACK number equal the sequence number + 1 during the handshake?
The SYN flag counts as one byte of sequence space, so acknowledging a SYN means expecting the next number.
What is the difference between TCP and UDP?
TCP is connection-oriented and reliable (handshake, ACKs, retransmission). UDP just sends datagrams with no setup and no guarantee, which makes it faster but is also why it's abused in amplification attacks.
What is a Dup ACK in Wireshark?
A repeated ACK for the same number, meaning the receiver is still waiting for a missing byte. Several in a row usually trigger a fast retransmission.