Deep dives on systems + scaling tricks like this one, straight to your inbox:
? https://techwithnikola.com/newsletter
Every TCP connection starts with three messages — SYN, SYN-ACK, ACK — before a single byte of your data moves. But why three? Why not two, one, or zero?
Instead of memorizing the handshake, we rebuild it from scratch. We start with the most aggressive design — zero setup messages — watch exactly what breaks, then add one message, then two, and see why three is the smallest design that actually works. Along the way: sequence numbers, the zombie-packet problem, why starting numbers are unpredictable, SYN floods, and a real packet capture opened in Wireshark so you can see the exact numbers TCP puts on the wire.
By the end, the three-way handshake won't be a fact you memorized — it'll be a design you could have invented.
? I write a free newsletter on systems trade-offs and the engineering decisions behind real software → https://techwithnikola.com
⏱️ Chapters
0:00 Intro — why three?
0:36 What is a connection?
1:52 Attempt 1: zero messages
4:25 Attempt 2: one message
4:52 Attempt 3: two messages
7:15 Three messages: SYN, SYN-ACK, ACK
9:25 Why a random server number?
11:12 The cost of waiting: SYN floods & SYN cookies
13:00 Real packets in Wireshark
14:51 One more defense: TIME-WAIT
16:08 Recap & newsletter
? Photo credit: Kevin Mitnick — Campus Party México 2010, CC BY 2.0