TCP is a reliable, ordered byte-stream transport between endpoints. “Connection-oriented” means its endpoints maintain state for a connection; it does not mean the protocol includes application authentication or an inherent liveness detector. RFC 9293 is the current base specification.
The opening exchange is usually described as SYN, SYN-ACK, ACK. The initiator proposes an initial sequence number. The responder acknowledges it and proposes its own. The final acknowledgment confirms the responder’s sequence space. The handshake synchronizes transport state; it does not establish that a user is authorized to access an application. That decision belongs to higher layers.
After setup, sequence numbers locate bytes in each direction and acknowledgments communicate the next byte expected. TCP may split application data into segments, retransmit data, or acknowledge bytes cumulatively. A packet trace therefore needs sequence-space reasoning rather than a one-packet-equals-one-message assumption. Windows also communicate receiver capacity and interact with congestion control; these are distinct mechanisms.
Teardown is also stateful. A FIN indicates that one endpoint has no more data to send in that direction. Since TCP is full duplex, the peer may still send data before closing its own side. A reset (RST) aborts a connection rather than completing an orderly close. Packet captures can show these control flags, but a middlebox or missing observation can complicate what the trace appears to say.
The accompanying state diagram intentionally shows only the common active-open path and a simplified close. RFC 9293 contains more states and edge cases, including simultaneous open, retransmission, TIME-WAIT and reset validation. The diagram is a teaching sketch, not a replacement for the specification.
Useful questions when reading a trace:
- Did the SYN reach the expected observation point?
- Is the SYN-ACK acknowledging the initiator’s sequence number plus one?
- Do later acknowledgments advance consistently with transmitted data?
- Is a FIN closing one direction or both?
- Does the trace show enough packets to distinguish a timeout from a capture gap?
Transport behavior is evidence about transport. It does not reveal the application’s intent by itself.