Handshake and Hang-up — SYN, FIN, RST

You just watched a connection reach ESTAB. Three packets got it there, and one of two packets will eventually end it. Which one is the mechanism behind every connection failure in the next lesson — so learn the three-and-two now. No header diagrams; just the packets that matter on call.

Opening: three packets

TCP opens with a fixed three-step exchange — the handshake:

When step 3 lands, both sides show ESTAB in ss (HPBN — Building Blocks of TCP).

Closing: the polite way and the rude way

A connection ends in exactly one of two ways:

FIN

The polite close. Each side says "I'm done" and waits for acknowledgment — a graceful, negotiated hang-up.

RST

The rude close. One side says "this connection is over, now" — no negotiation, no waiting. It means something is wrong, or someone refused.

That single distinction is the payoff of the whole unit:

Two states you'll see named

Reading ss at closing time you'll meet two states. Just recognize them for now — the forensics come in Unit 9:

TIME_WAIT

The side that closed first waits a short while before releasing the socket, to absorb any stray late packets. Normal and healthy.

CLOSE_WAIT

The peer sent FIN, but this app hasn't closed its end yet. Piles of these usually mean an application bug — a connection someone forgot to close.

Next: point that distinction at real curl -v output and turn it into the five-signature failure alphabet.