What it is
The 3-way handshake is the process TCP uses to establish a reliable connection between two endpoints. Before application data is exchanged, the client and server confirm that both sides can send and receive traffic and agree on the initial sequence numbers used to track bytes in the session.
The three steps
First, the client sends a SYN packet containing its initial sequence number. The server replies with SYN-ACK, acknowledging the client and offering its own sequence number. The client returns an ACK. After that third message, the connection is established and protocols such as HTTPS can begin their own negotiation.
Why it matters for security
Many SYN packets without the final ACK can indicate packet loss, a broken firewall rule, or a SYN-flood attack.
A completed handshake proves network reachability, not that the remote service or user is trustworthy.
TCP flags and timing in packet captures help troubleshoot connection resets, timeouts, and scanning activity.
Safe troubleshooting
Confirm the destination IP and port, then compare client, server, and firewall logs.
Use a packet capture only on networks and systems you are authorized to inspect.
Rate-limit suspicious connection attempts and use SYN cookies or equivalent protections where appropriate.
Investigate repeated failures before increasing timeouts, because the cause may be filtering or abuse.