How to use the TCP Three-Way Handshake Visualizer
- 1. Choose a scenarioA normal connection, a lost SYN-ACK, or a closed port.
- 2. Set the numbersInitial sequence numbers and how many bytes each side sends.
- 3. Step or playMove one segment at a time, or play it all and see the full table.
What the handshake does
Before TCP sends any data, both sides agree on starting sequence numbers. The client sends SYN with its initial sequence number (ISN). The server answers SYN-ACK with its own ISN and acknowledges the client's ISN + 1, because a SYN uses up one sequence number. The client's ACK acknowledges the server's ISN + 1, and both sides are ESTABLISHED. After that, sequence numbers count bytes: sending 120 bytes moves the client's sequence number on by 120. Closing takes four segments (FIN, ACK, FIN, ACK), and the side that closes first waits in TIME-WAIT. The diagram labels each side's state as it changes.
The numbers follow the TCP standard (RFC 9293), which we checked in every scenario, including when sequence numbers wrap around past 4,294,967,295 back to 0.
Worked example
With client ISN 1000 and server ISN 5000: SYN (seq 1000), SYN-ACK (seq 5000, ack 1001), ACK (seq 1001, ack 5001). The client sends 120 bytes (seq 1001), so the server acknowledges 1121; the server replies with 800 bytes (seq 5001), acknowledged as 5801. The close ends with the client's final ACK of 5802. That's 11 segments in all, 3 of them for the handshake.
See it for real
- Open Wireshark, filter
tcp.flags.syn == 1, and visit any website to see real handshakes. - Wireshark shows relative sequence numbers (starting at 0) by default; turn that off in the TCP preferences to see real ISNs.
- The closed-port scenario is what "connection refused" means.
Frequently asked questions
Why are ISNs random?
Predictable sequence numbers let attackers inject fake packets into a connection; random ISNs make that much harder.
What is a SYN flood?
An attacker sends many SYNs and never completes the handshake, filling the server's queue; SYN cookies defend against it.
Is the TCP handshake visualizer free?
Yes. You can open the TCP handshake visualizer and try everything without signing up. When you see all segments for the first time, we ask once for your name and WhatsApp number; after that it, and every other Uncodemy tool, opens straight away.