Visual Learning · 01 · Live
TCP 3-Way Handshake
SYN → SYN-ACK → ACK with glowing packet — foundation of reliable sessions.
CYNARKS|Cyber Flow Explorer
Teaching simulation · not live capture
TCP 3-Way Handshake
Lab hosts only. Never flood systems outside written scope.
Real world · Every HTTPS page load starts with a TCP handshake to port 443 before TLS or HTTP can run.
Attack · Attackers may SYN-flood or spoof RSTs — outside this module’s scope; focus on the happy path first.
Defense · Stateful firewalls track handshake state; incomplete handshakes are rate-limited.
- Control · SYN cookies / connection rate limits on public listeners
- Control · Allow only expected ports (80/443) from untrusted zones
- Control · Monitor half-open connection spikes
1. SYN
Client
192.168.1.10:52344SYN
seq=1000 ack=—
Server
10.0.0.5:80Client picks an initial sequence number (ISN=1000) and asks the server to open a connection.
seq=1000 ack=—
- #1 client → server SYN seq=1000 ack=—
Space · ← → · R restart