TechKnowSurge
Cisco CCNA 1.5 CompTIA A+ Core 1 2.1 Cisco CCST Cybersecurity 2.1 Cisco CyberOps Associate 4.8
VideoNetworkFree

DEMO: Wireshark, TCP Connections

TCP connection establishment and termination are examined through a live Wireshark packet capture, tracing the three-way handshake, data transfer, and four-step connection teardown between two networked devices.

Complete this video to capture a CTF flag worth 1 point.

About this video

TCP is a connection-oriented protocol, and understanding how it establishes and terminates connections is foundational to network analysis and troubleshooting. This content uses a real Wireshark packet capture from a browser session between two devices to trace every stage of a TCP connection, from the initial handshake through data transfer and final teardown. The Wireshark connection wire feature is used to isolate and track the packets belonging to a single TCP stream, filtering out unrelated traffic and keeping the analysis focused on one specific source port. The three-way handshake is examined packet by packet. The client initiates the connection by sending a SYN segment with the acknowledgment flag off, because there is nothing yet to acknowledge and the acknowledgment number field carries no meaningful value at that stage. The server responds with a SYN-ACK, setting the acknowledgment number to the next expected sequence number from the client. The client completes the handshake with an ACK, confirming the sequence number it expects next from the server. Once established, an HTTP GET request is sent over the same port and the server delivers the requested web page content in return. Connection termination follows a four-step process. After fulfilling the request, the server sends a FIN-ACK to signal it has finished transmitting, and the client acknowledges this while keeping its side of the connection open briefly in case additional requests are needed. When the browser is closed, the client initiates its own FIN-ACK to close the remaining half of the connection, and the server acknowledges it. This asymmetric teardown reflects TCP's half-close behavior and ensures both sides cleanly release the connection before resources are freed.

What you'll learn

What's covered

TCP Connection Process

Aligned to

Cisco CCNA
1.5 Compare TCP to UDP
CompTIA A+ Core 1
2.1 Compare and contrast Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) ports, protocols, and their purposes.
Cisco CCST Cybersecurity
2.1 Describe TCP/IP protocol vulnerabilities
Cisco CyberOps Associate
4.8 Interpret the fields in protocol headers as related to intrusion analysis

Key terms

Transmission Control Protocol
TCP
A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Three-Way Handshake
The TCP process of establishing a connection using three steps — SYN, SYN-ACK, and ACK — to synchronize communication between two devices.
SYN
A TCP control flag used to initiate a connection request, signaling synchronization of sequence numbers between two hosts.
SYN-ACK
A TCP response flag combination sent by a server to acknowledge a SYN request and synchronize its own sequence number with the client.
ACK
A TCP control flag used to acknowledge receipt of data or a connection request, confirming the sequence number expected next.
FIN
A TCP control flag used to signal the end of a connection, indicating that the sender has finished transmitting data.

Transcript

The Captured Connection

What I have here is a capture I already made of communication between my demo laptop and the demo Pi. We opened up a browser and we made a connection and we captured that data, and that's the same data that I'm going to use right here.

I'm going to jump down to when the connection is established — this is when I opened up the browser. The connection is established here, and we're going to get a little more in depth into this. Then we see the data actually being transferred: it's the HTTP GET request that happens, and then the demo Pi does respond. And then towards the end here we see the termination of that connection.

During this process it actually established two different connections. We can see that even after the process of getting this web page all happened, there's a second connection that was established between these two devices. This is for 60424. We're going to ignore that side of it and we're just going to concentrate on this one. So that is the source port that opened up this connection, and let's see how this opened up this connection, how it communicated, and then how it closed this connection.

First of all, what I want to point out is that this whole connection wire allows us to easily identify what is part of this connection. On the left hand side here we see that it starts — that's the horizontal line right here — it starts at this packet and then moves down and ends at this packet right here. As we go through here there's also some dotted lines. The dotted lines show us that that is not actually part of this communication, so we can exclude those that are not a part of this communication. So we're just going to look at this 60425.

Connection Establishment

The first thing that's sent to establish the connection is this SYN bit turned on. We can actually look down in our layer four here. If I open up this layer four, we see the flags, and I'll open up the flags, and we see the SYN bit is turned on just by one.

And then we get a SYN acknowledgement that gets sent back. So the SYN is the request from the demo laptop saying I would like to make a connection to you. Then the demo Pi sends an acknowledgement back: okay, let's make a connection. And then the demo laptop sends back and says great, we have a connection.

With this, just know that one of the reasons why the acknowledgement is not turned on with the SYN is because the field that is the acknowledgement number is zero. It's not relevant at this point in time; there's nothing to acknowledge back, and that's the reason why the acknowledgement field is not turned on. Whereas if I look at the sequence number here, the sequence number for this is this very large number here. So when the demo Pi does reply back, it actually knows what the next expected sequence number is, so it has the next expected sequence number, or the acknowledgement number, specified in here. That is the reason why that flag then is turned on, and I can open this up and I can see that the acknowledgement flag is turned on, and that's because this acknowledgement number is relevant at this point in time.

So there's the three-way handshake. The demo laptop says I would like to make a connection with you. The demo Pi says let's make a connection, I'm acknowledging this by having an acknowledgement number of what is the next expected sequence number. And then the demo laptop says great, we have a connection, here is the next sequence number I'm expecting from you.

Data Transfer and Termination

Then we see the actual data transfer. We have the web page that's requested, and it's requested on this same port — if we scroll through here, 60425 — so it's the same port. This communication happens back and forth.

Then after this is fulfilled, after the demo Pi says okay, I've fulfilled my part of this bargain, it actually closes out. I'm going to scroll down. It actually closes the connection at this point and sends a FIN acknowledgement, so the FIN bit is turned on. That is the demo Pi saying, all right, I'm closing this out. And the demo laptop says great, I acknowledge that you've fulfilled your part of the bargain here.

Now the connection actually stays open at this point. It stays open just in case there's any other communication that needs to happen, any other requests that need to happen. So there is some sort of time in which this connection will stay open.

And then what happened next is I closed the browser. When the browser closed, the demo laptop realizes no, I'm not going to make any more requests, because that browser is not even open. So now I need to terminate this part of the conversation as well. At this point in time the demo laptop makes a request to finish and acknowledge that this port is being closed, that this connection is being closed, and then the demo Pi acknowledges that that connection is being closed.

So there are two parts to this, and it ends up being a back and forth of four different packets that transfer back and forth to disconnect, or to terminate, this connection right here.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →