Follow a TCP connection

TCP begins a normal connection with a three-way handshake: SYN, SYN-ACK, and ACK. The client asks to talk, the server agrees, and the client confirms. The exchange establishes state and initial sequence numbers on both endpoints.

You can watch a handshake happen. In one terminal, capture packets for one connection:

sudo tcpdump -ni any -c 3 "port 443 and host 1.1.1.1"

In another, trigger it with curl https://1.1.1.1/ -so /dev/null. The capture shows:

IP 192.168.1.20.55102 > 1.1.1.1.443: Flags [S], seq 3402118443
IP 1.1.1.1.443 > 192.168.1.20.55102: Flags [S.], ack 3402118444
IP 192.168.1.20.55102 > 1.1.1.1.443: Flags [.], ack 1

[S] is the SYN, [S.] is the SYN-ACK, and the final [.] with an ack is the closing step of the handshake. Note the server acknowledged 3402118444 — exactly one more than the client’s starting sequence number.

Sequence numbers and reliability

Sequence numbers describe positions in the byte stream. Acknowledgments tell the sender which bytes arrived. Missing acknowledgments can trigger retransmission — the sender’s timer expires, and it sends the unacknowledged bytes again. This is the machinery that turns unreliable IP packets into a reliable stream.

Your kernel exposes live statistics for its connections:

ss -ti dst 1.1.1.1

ESTAB 0 0 192.168.1.20:55102 1.1.1.1:443
    cubic rtt:9.7/4.3 cwnd:10 bytes_acked:517 retrans:0/0

rtt is the measured round-trip time. retrans:0/0 means nothing needed retransmitting. On a bad Wi-Fi link or congested path you’ll see that counter climb — the connection still works, but every retransmission costs at least one round trip of waiting.

Flow control, congestion control, and closing

Flow control protects the receiver from too much queued data, while congestion control protects the network path — the cwnd (congestion window) value above is the sender pacing itself. These mechanisms affect speed without changing the application protocol.

A graceful close uses FIN and ACK exchanges: each side says “I’m done sending” and confirms the other’s goodbye. A reset, or RST, ends the connection immediately with no goodbye. Seeing RST where you expected data usually means no process was listening, a firewall rejected the connection, or a server gave up on you.

A successful handshake still does not guarantee a valid application response. TCP delivered the bytes; whether the application on top sends something sensible is a separate question, and a separate layer to debug.