TCP Handshake Animator

Walk the TCP connection state machine one segment at a time: the three-way handshake (SYN, SYN-ACK, ACK), a graceful close (FIN/ACK through TIME-WAIT), a simultaneous close (crossing FINs through CLOSING), or an abrupt reset (RST). Each step shows the segment on the wire and the state of both endpoints: CLOSED, SYN-SENT, ESTABLISHED, and the rest.

Rendered when the site was built, by the same state machine the browser runs. No JavaScript required. With JavaScript on, this is replaced by the interactive ladder, which reveals one segment at a time.

The 11 states

Every RFC 793 connection state, in the order the machine walks them: CLOSED · LISTEN · SYN-SENT · SYN-RECEIVED · ESTABLISHED · FIN-WAIT-1 · FIN-WAIT-2 · CLOSE-WAIT · CLOSING · LAST-ACK · TIME-WAIT. A connection is only ever in one of them at each end, and the traces below name both ends at every step.

TCP Three-Way Handshake

3 segments, 4 steps.

· (initial) · client=CLOSED server=LISTEN
step 1/3 · C->S SYN seq=100 ack=0 len=0 · client=SYN-SENT server=LISTEN
step 2/3 · S->C SYN,ACK seq=500 ack=101 len=0 · client=SYN-SENT server=SYN-RECEIVED
step 3/3 · C->S ACK seq=101 ack=501 len=0 · client=ESTABLISHED server=ESTABLISHED

TCP Three-Way Handshake: step by step
Step	Segment	Client	Server	What happened
1	none	CLOSED	LISTEN	Client is CLOSED; the server is LISTENing for connections.
2	SYN	SYN-SENT	LISTEN	Client sends a SYN with its initial sequence number (ISN=100) and enters SYN-SENT.
3	SYN,ACK	SYN-SENT	SYN-RECEIVED	Server acknowledges the SYN (ack=101) and sends its own SYN (ISN=500), entering SYN-RECEIVED.
4	ACK	ESTABLISHED	ESTABLISHED	Client acknowledges the server's SYN (ack=501); the handshake is complete and both ends are ESTABLISHED.

Graceful Connection Teardown

4 segments, 6 steps.

· (initial) · client=ESTABLISHED server=ESTABLISHED
step 1/4 · C->S FIN,ACK seq=200 ack=800 len=0 · client=FIN-WAIT-1 server=ESTABLISHED
step 2/4 · S->C ACK seq=800 ack=201 len=0 · client=FIN-WAIT-2 server=CLOSE-WAIT
step 3/4 · S->C FIN,ACK seq=800 ack=201 len=0 · client=FIN-WAIT-2 server=LAST-ACK
step 4/4 · C->S ACK seq=201 ack=801 len=0 · client=TIME-WAIT server=CLOSED
· (initial) · client=CLOSED server=CLOSED

Graceful Connection Teardown: step by step
Step	Segment	Client	Server	What happened
1	none	ESTABLISHED	ESTABLISHED	The connection is open; both ends are ESTABLISHED.
2	FIN,ACK	FIN-WAIT-1	ESTABLISHED	Client begins an active close, sending FIN and entering FIN-WAIT-1.
3	ACK	FIN-WAIT-2	CLOSE-WAIT	Server acknowledges the FIN (ack=201): the client enters FIN-WAIT-2 and the server enters CLOSE-WAIT.
4	FIN,ACK	FIN-WAIT-2	LAST-ACK	Server finishes sending and closes, emitting its own FIN and entering LAST-ACK.
5	ACK	TIME-WAIT	CLOSED	Client acknowledges the server's FIN (ack=801): the server reaches CLOSED and the client enters TIME-WAIT.
6	none	CLOSED	CLOSED	TIME-WAIT lasts 2·MSL so any straggling segments drain before the client finally reaches CLOSED.

Simultaneous Close (Crossing FINs)

4 segments, 6 steps.

· (initial) · client=ESTABLISHED server=ESTABLISHED
step 1/4 · C->S FIN,ACK seq=200 ack=800 len=0 · client=FIN-WAIT-1 server=ESTABLISHED
step 2/4 · S->C FIN,ACK seq=800 ack=200 len=0 · client=FIN-WAIT-1 server=FIN-WAIT-1
step 3/4 · C->S ACK seq=201 ack=801 len=0 · client=CLOSING server=CLOSING
step 4/4 · S->C ACK seq=801 ack=201 len=0 · client=TIME-WAIT server=TIME-WAIT
· (initial) · client=CLOSED server=CLOSED

Simultaneous Close (Crossing FINs): step by step
Step	Segment	Client	Server	What happened
1	none	ESTABLISHED	ESTABLISHED	The connection is open; both ends are ESTABLISHED.
2	FIN,ACK	FIN-WAIT-1	ESTABLISHED	Client closes, sending FIN and entering FIN-WAIT-1, but this FIN is still in flight.
3	FIN,ACK	FIN-WAIT-1	FIN-WAIT-1	Server closes at the same moment, before the client's FIN arrives (ack=200 proves it has not seen it). The two FINs cross on the wire and both ends sit in FIN-WAIT-1.
4	ACK	CLOSING	CLOSING	The crossed FINs land: each end receives its peer's FIN while still awaiting an ACK for its own, so both enter CLOSING, the simultaneous-close state. The client acknowledges the server's FIN (ack=801).
5	ACK	TIME-WAIT	TIME-WAIT	Server acknowledges the client's FIN (ack=201); as the two ACKs land, CLOSING gives way to TIME-WAIT on both ends: in a simultaneous close, neither side gets to skip it.
6	none	CLOSED	CLOSED	Both ends closed actively, so both hold TIME-WAIT for 2·MSL while stray segments drain, then reach CLOSED.

Connection Reset (RST)

1 segment, 2 steps.

· (initial) · client=ESTABLISHED server=ESTABLISHED
step 1/1 · C->S RST seq=200 ack=0 len=0 · client=CLOSED server=CLOSED

Connection Reset (RST): step by step
Step	Segment	Client	Server	What happened
1	none	ESTABLISHED	ESTABLISHED	The connection is open; both ends are ESTABLISHED.
2	RST	CLOSED	CLOSED	Client sends RST, tearing the connection down immediately: no handshake, both ends drop to CLOSED.

Either side of this state machine has a tool of its own: the Packet Analyzer takes a real captured segment apart down to its flags and sequence numbers, and the Local HTTP Request Constructor builds the request that rides on the connection once it is open.

About this lab3 paragraphs

Four scenarios cover the connection's whole life: the open, the orderly close, the close where both ends hang up at once, and the abort. Each is a fixed trace rather than a live socket, so stepping backwards is free and the same segment always carries the same numbers.

What it leaves out is everything that makes TCP hard in practice. There is no loss, no retransmission, no window arithmetic, no delayed acknowledgement and no simultaneous open (the mirror image of the simultaneous close, with crossing SYNs). Those belong to the congestion story; this is the state machine.

TIME-WAIT is the one place the animation is worth reading twice. It is the state that looks like a bug and is not: the endpoint that closed first holds on so a late duplicate cannot land on a new connection reusing the same pair of ports. In the simultaneous close both ends closed actively, so both pay it, and CLOSING (the state between the crossed FINs and their acknowledgments) appears in that trace and nowhere else.