Learn
LoginRegister
FundamentalsBeginnerFree lab

Fundamentals · browser room

TCP 3-Way Handshake

Beginner60 ptsTCP/IP

Objective

See SYN → SYN-ACK → ACK open a reliable lab session.

Cyber Flow Explorer · 3 steps · Network / Sequence / Packet / Code.

Isolated browser lab. Practice here first — no live targets. Optional deeper practice lives in the Academy library after you finish this room.

Answer panel

Challenge workspace

Complete the room tasks, then submit here to mark the room done.

CYNARKS

Teaching simulation · not live capture

TCP 3-Way Handshake

Lab hosts only. Never flood systems outside written scope.

Real world · Every HTTPS page load starts with a TCP handshake to port 443 before TLS or HTTP can run.

Attack · Attackers may SYN-flood or spoof RSTs — outside this module’s scope; focus on the happy path first.

Defense · Stateful firewalls track handshake state; incomplete handshakes are rate-limited.

  • Control · SYN cookies / connection rate limits on public listeners
  • Control · Allow only expected ports (80/443) from untrusted zones
  • Control · Monitor half-open connection spikes

1. SYN

Client

192.168.1.10:52344
SYN

seq=1000 ack=—

Server

10.0.0.5:80
Client picks an initial sequence number (ISN=1000) and asks the server to open a connection.

seq=1000 ack=—

  • #1 client → server SYN seq=1000 ack=—

Space · ← → · R restart

Hint

Client speaks first; server answers with SYN+ACK.

Why this is correct

SYN → SYN-ACK → ACK before application data. Sequence numbers are simplified for learning.