The TCP connection state machine describes how a reliable network connection opens, transfers data, closes, and recovers from timing issues. Students need this cheat sheet because TCP state names can look similar, but each one represents a specific step in communication. Understanding the state machine helps explain web connections, sockets, packet captures, and network troubleshooting.
It also connects abstract protocol rules to real events such as SYN, ACK, FIN, and timeout.
Key Facts
- A normal client open follows CLOSED -> SYN-SENT -> ESTABLISHED after sending SYN and receiving SYN-ACK, then sending ACK.
- A normal server open follows CLOSED -> LISTEN -> SYN-RECEIVED -> ESTABLISHED after receiving SYN, sending SYN-ACK, and receiving ACK.
- The TCP three-way handshake is SYN, SYN-ACK, ACK, and it synchronizes sequence numbers in both directions.
- A normal active close follows ESTABLISHED -> FIN-WAIT-1 -> FIN-WAIT-2 -> TIME-WAIT -> CLOSED.
- A normal passive close follows ESTABLISHED -> CLOSE-WAIT -> LAST-ACK -> CLOSED after receiving FIN, sending ACK, sending FIN, and receiving ACK.
- TIME-WAIT lasts for 2MSL so delayed duplicate segments can expire before the same connection identifiers are reused.
- A TCP connection is identified by the 4-tuple source IP, source port, destination IP, and destination port.
- Simultaneous close can move both endpoints through CLOSING when each side sends FIN before receiving the other side's ACK.
Vocabulary
- State machine
- A model that lists possible states and the events that cause transitions between those states.
- SYN
- A TCP control flag used to start a connection and synchronize initial sequence numbers.
- ACK
- A TCP control flag used to confirm that data or a control segment has been received.
- FIN
- A TCP control flag used by one endpoint to signal that it has no more data to send.
- ESTABLISHED
- The TCP state in which both endpoints have completed the handshake and can exchange data.
- TIME-WAIT
- The TCP state that keeps a closed connection record temporarily so delayed packets do not affect a later connection.
Common Mistakes to Avoid
- Confusing SYN-SENT with SYN-RECEIVED is wrong because SYN-SENT is usually the active opener's state, while SYN-RECEIVED is usually the listener's state after receiving a SYN.
- Skipping the final ACK in the three-way handshake is wrong because the server does not fully know the client received its SYN-ACK until that ACK arrives.
- Assuming both sides close at the same time is wrong because TCP is full-duplex, so one side can stop sending while still receiving data.
- Treating TIME-WAIT as an error is wrong because TIME-WAIT is a normal safety state used to handle delayed duplicates and retransmissions.
- Mixing up CLOSE-WAIT and FIN-WAIT is wrong because CLOSE-WAIT belongs to the endpoint that received a FIN, while FIN-WAIT belongs to the endpoint that sent a FIN.
Practice Questions
- 1 A client starts in CLOSED, sends SYN, receives SYN-ACK, and sends ACK. List the client state sequence.
- 2 A server starts in LISTEN, receives SYN, sends SYN-ACK, and receives ACK. What state is the server in after the final ACK?
- 3 An active closer moves from ESTABLISHED to FIN-WAIT-1, then FIN-WAIT-2, then TIME-WAIT. What two control flags must it send or receive to move through these stages?
- 4 Why does TCP keep a connection in TIME-WAIT instead of immediately deleting all connection state after the final ACK?