The three-way handshake

Hello, hello back, thanks

Before two machines exchange any real data over TCP, they do a little three-step greeting called the three-way handshake:

• SYN — the client says “hello, can we talk?”
• SYN-ACK — the server says “hello back, yes”.
• ACK — the client says “great, thanks” and the connection is open.

Why care? The machine that sends the very first SYN is the one that started the connection — usually the client, or the attacker. tshark can show the TCP flags on each packet so you can see the handshake:

tshark -r /home/student/case/capture.pcap -T fields -e ip.src -e ip.dst -e tcp.flags.str 2>/dev/null

In the terminal

student@vulntech:~$ tshark -r /home/student/case/capture.pcap -T fields -e ip.src -e ip.dst -e tcp.flags.str 2>/dev/null
10.10.10.5	93.184.216.34	··········S·
93.184.216.34	10.10.10.5	·······A··S·
10.10.10.5	93.184.216.34	·······A····
10.10.10.5	93.184.216.34	·······AP···

Tip: A lone SYN with no SYN-ACK back means the knock went unanswered — the door was closed. That pattern matters a lot in the next module on port scans.