How TCP/IP Works: From Handshake to Data Transfer

Every time you load a webpage, send an email, or stream a video, TCP/IP is doing the heavy lifting. Unlike a protocol that just fires packets into the network and hopes for the best, TCP establishes a connection, sequences every byte, retransmits anything lost, and reassembles data in the correct order — across the entire internet, between devices that have never communicated before.

The TCP/IP Protocol Stack

Application Layer   (HTTP, DNS, SSH)
Transport Layer      (TCP, UDP)        ← TCP lives here
Internet Layer       (IP, ICMP)
Network Access       (Ethernet, Wi-Fi)

TCP sits between the application (your browser) and the internet layer (IP). It takes data from applications, segments it, and hands it to IP for delivery. On the receiving end, it reassembles segments back into the original data stream.

TCP vs UDP: The Two Transport Protocols

The TCP Three-Way Handshake

Before any data can be exchanged, TCP establishes a connection using the three-way handshake, which synchronises sequence numbers and prevents duplicate connections from old, delayed packets.

Client                      Server
  |────── SYN (seq=100) ────→|  1. Client sends SYN
  |←── SYN-ACK (seq=300, ────|  2. Server responds with SYN-ACK
  |        ack=101)           |
  |────── ACK (seq=101, ────→|  3. Client acknowledges
  |        ack=301)           |
  |══════ Data Transfer ══════|  Connection established!

Step 1 — SYN

The client sends a segment with the SYN flag set, including a randomly chosen sequence number and the destination port. The client enters SYN-SENT state.

Step 2 — SYN-ACK

The server responds with SYN and ACK flags set: its own random sequence number plus an acknowledgement number of client-seq + 1. The server enters SYN-RECEIVED state.

Step 3 — ACK

The client sends back an ACK segment. Both sides enter ESTABLISHED state and data transfer can begin.

Port Numbers: How TCP Knows Which Application to Deliver To

TCP uses port numbers to identify which application on a device should receive the data — think of the IP address as the building, the port as the apartment number.

TCP Data Transfer: Sequence Numbers and ACKs

Sender sends:  Seq=101 (bytes 1-100)
               Seq=201 (bytes 101-200)
               Seq=301 (bytes 201-300)

Receiver ACKs: Ack=301 ("I got up to byte 300, send byte 301")

If Seq=201 is lost: sender retransmits after timeout,
receiver reassembles the segments in order.

TCP Connection Termination

When data transfer is complete, TCP performs a four-way teardown (FIN, ACK, FIN, ACK), then enters TIME-WAIT state (about 2 minutes) to handle delayed packets before fully closing.

Flow Control and Congestion Control

Flow control (sliding window): the receiver advertises a window size — how much data it will buffer — and the sender can't exceed it without waiting for an ACK.

Congestion control: Slow Start begins with a small congestion window and doubles each RTT until a threshold; Congestion Avoidance then increases linearly; Fast Retransmit resends immediately on three duplicate ACKs.

Test Your Knowledge