Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

TCP Working: 3-Way Handshake & Reliable Communication

When data is sent over the internet , it doesn't magically reach the other side safely. Packets can get lost, arrive could be out of order, or never arrive at all. That's why TCP (Transmission Control Protocol) exists. TCP makes sure…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

When data is sent over the internet , it doesn't magically reach the other side safely.

Packets can get lost, arrive could be out of order, or never arrive at all.



That's why TCP (Transmission Control Protocol) exists.



TCP makes sure that two computers:




  • agree before they start talking

  • send data in the correct order

  • and confirm that everythign is received properly



Before any real data is sent, TCP first creates a connection using a process called the 3 way handshake.

After that it carefully manages data transfer to ensure reliablity, correctness, and completeness.



In this article, we'll understand how TCP works - steps by steps - using simple language, real-life example, and clear diagrams, without diving into complex internals.









1. What is TCP and Why it is needed



TCP (Transmission Control Protocol) is a set of rules that helps computers communicate reliability.



It's job is simple:




Make sure data reaches the other side correctly, completely, and in order.




Without TCP the internet would feel unreliable and messy.









2. Problem TCP Is Designed to solve



If data is send without rules, many problems can heppen:




  • Data packets can get lost

  • Data can arrive out of order

  • Data can be duplicate

  • Sender may not know if the receiver got the data



TCP solves all of these problems by checking, comfirming and retrying.






3. What Is the TCP 3-Way Handshake



Before sending real data , TCP first creates a connection.

This setup process is called 3-way handshake



Think of it like starting a phone call. In phone call you don't start talking immediately - first, both sides

confirm they are ready.









4. Step-by-Step: SYN, SYN-ACK, ACK



Let's walk through it slowly.






step 1: SYN (client-server)



Client says:




"Hey server, I want to talk , Are you there?"




This message is called SYN (Synchronize).






Step 2: SYN-ACK (Server → Client)



Server replies:




"Yes, I am here and ready."




This reply is called SYN-ACK.






Step 3: ACK (Client- Server)



Client confirms:




"Great, let's start."




This final message is Ack.

Now the connection is established






Diagram 1: TCP 3-Way Handshake






flowchart LR
A[Client] -->|SYN| B[Server]
B -->|SYN-ACK| A
A -->|ACK| B












5. How Data Transfer Works in TCP



Once the connection is open, data starts flowing.



TCP does not send data as one big piece.

It breaks data into small packets.

Each packet has:




  • a sequence number

  • so the receiver know the correct order



After receiving packets, the receiver sends back ACKs (acknowledgements).









6. How TCP Ensures Reliability, Order, and Correctness



TCP is smart, and it constantly checks:

Reliabilty




  • If packet is missing -> re-send

  • If ACK is not received -> retry



Correct order




  • Uses sequesnce number

  • Rearranges packets if needed



Correct data




  • Detects corrupted packets

  • Requests retranmission









Diagram 2: Data Transfer With ACKs






flowchart LR
A[Client sends data seq 1] --> B[Server]
B -->|ACK 1| A
A -->|seq 2| B
B -->|ACK 2| A












7. Packet Loss and Retransmission



Sometimes packets get lost due to:




  • network congetion

  • weak signals

  • router issues



TCP handles this automitically.

If ACK is not receives:




i did not got the confirmation - i'll send it again."










Diagram 3: Packet Loss Handling






flowchart LR
A[Client sends packet] --> B[Packet lost]
A -->|Timeout| C[Resend packet]
C --> D[Server receives]
D -->|ACK| A












8. How a TCP Connection Is Closed



When communication is done, TCP close the connection properly.



It uses:





  • FIN-> "I am done sending"


  • ACK-> "I got it"



Both side confirm before closing.









Diagram 4: TCP Connection Lifecycle






flowchart LR
A[Connection setup] --> B[Data transfer]
B --> C[FIN sent]
C --> D[ACK received]
D --> E[Connection closed]












Final Mental Model (Easy to Remember)




  1. TCP works like a careful connection:

  2. Say hello (3-way handshake)

  3. Talk clearly (data + ACKs)

  4. Repeat if needed (retransmission)

  5. Say goodbye properly (Fin + ACK)









One-line Takeaway




TCP makes sure data is delivered safely, in order and completely


1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - TCP Working: 3-Way Handshake & Reliable Communication
id: b5101cc4-eb03-4614-a651-683b8e937668
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "TCP Working: 3-Way Handshake &" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("TCP Working 3-Way Handshake  Reliable Co")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*TCP Working 3-Way Handshake  Reliable Co*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "TCP Working 3-Way Handshake  Reliable Co"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Analyse für identifizierte Bedrohung auf Basis von Live-CTI (ENISA EUVD): CVSS 0.0 · EPSS 0.0% · CISA KEV: nein. Handlungsableitung aus den verlinkten Hersteller-Quellen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten TCP Working: 3-Way Handshake & Reliable Communication

Thematisch verwandte Begriffe: Working, 3Way, Handshake, Reliable · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

💬 Kommentare werden geladen…
Zum Aktualisieren ziehen
ZERO-DAY CVE-2025-71424 | Contrast, Edgeless Systems' runtime for confidential containers on Kuber…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag