Why does TCP use a three-way handshake, and why not two?
The handshake lets both sides agree on starting sequence numbers and confirm that each can send and receive. Two steps would prove only that the server can hear the client, so a delayed old SYN could make the server open a connection nobody wants.
Explain it simply
Two people on a noisy phone line: "Can you hear me?" "Yes, can you hear me?" "Yes, I can." Only after the third line does each person know the other can hear them, and that both are ready.
Example
Client Server
SYN, seq=1000 ---->
<---- SYN-ACK, seq=5000, ack=1001
ACK, seq=1001, ack=5001 ---->
(connection established; data can flow)Each side picks its own initial sequence number (ISN). Step 1 tells the server the client's ISN. Step 2 acknowledges it and shares the server's ISN. Step 3 acknowledges the server's ISN. A SYN counts as one byte of sequence space, which is why ack is ISN plus 1.
With only two steps, the server could not tell whether its own ISN had reached the client. A stale SYN from an earlier, dead attempt would also leave the server holding a half-open connection forever. The third message confirms the client is alive and wants this connection.
What to say in the interview
"Three steps are the minimum for both sides to synchronise sequence numbers and prove two-way reachability. SYN, SYN-ACK, ACK. The third packet also protects against old duplicate SYNs creating phantom connections."
Common mistakes
- Saying the handshake is for security. It is for synchronisation, not authentication.