TCP uses the 3-way-handshake mechanism. I understand how it works pretty well but I wonder why it's not 4, or even 5-way? Is it because that's too much overhead and is not needed?


The startup performance of a TCP connection is dictated by the round trip time, and every phase of the handshake takes one half of that. The more delay, the worse the initial performance of the connection.

If TCP could be securely and safely completed in a one-way handshake, it would be, because that would be faster. So, it is 3-way not because there is any special virtue in 3, but because that is the minimum number of exchanges required to get going effectively.

In other words, yes, your assessment is exactly right: more steps in the handshake is more overhead, and are not needed.

Compare it it the recent Google SSL "false start" effort to shave a step off the SSL handshake, where someone figured out a way to take one less step in a protocol someone already thought was at the absolute minimum.

| improve this answer | |
  • Interesting article that on Google's SSL discovery. #justSaying – SimonJGreen Mar 11 '12 at 17:49

Daniel did a good job explaining in his answer why the 3-way handshake is the most common method of setting up a tcp connection but it's not the only way to make a tcp connection.

There is the "simultaneous open" connection which is really each client doing a 2-way handshake. As well as the split-handshake which made news last year as it can be used as an attack vector to by-pass incoming firewall rules and IPS. Also called the sneak-ack attack.

| improve this answer | |

Shall we say like this, three way handshake is mandatory to exchange network information between two peers and get acknowledged. Example: Maximum Segment Size (MSS)

In other scenario, if both client/server send out syn then one handshake reduced to two.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.