TCP connection establishment and termination are examined through a live Wireshark packet capture, tracing the three-way handshake, data transfer, and four-step connection teardown between two networked devices.
TCP Connection Process
What I have here is a capture I already made of communication between my demo laptop and the demo Pi. We opened up a browser and we made a connection and we captured that data, and that's the same data that I'm going to use right here.
I'm going to jump down to when the connection is established — this is when I opened up the browser. The connection is established here, and we're going to get a little more in depth into this. Then we see the data actually being transferred: it's the HTTP GET request that happens, and then the demo Pi does respond. And then towards the end here we see the termination of that connection.
During this process it actually established two different connections. We can see that even after the process of getting this web page all happened, there's a second connection that was established between these two devices. This is for 60424. We're going to ignore that side of it and we're just going to concentrate on this one. So that is the source port that opened up this connection, and let's see how this opened up this connection, how it communicated, and then how it closed this connection.
First of all, what I want to point out is that this whole connection wire allows us to easily identify what is part of this connection. On the left hand side here we see that it starts — that's the horizontal line right here — it starts at this packet and then moves down and ends at this packet right here. As we go through here there's also some dotted lines. The dotted lines show us that that is not actually part of this communication, so we can exclude those that are not a part of this communication. So we're just going to look at this 60425.
The first thing that's sent to establish the connection is this SYN bit turned on. We can actually look down in our layer four here. If I open up this layer four, we see the flags, and I'll open up the flags, and we see the SYN bit is turned on just by one.
And then we get a SYN acknowledgement that gets sent back. So the SYN is the request from the demo laptop saying I would like to make a connection to you. Then the demo Pi sends an acknowledgement back: okay, let's make a connection. And then the demo laptop sends back and says great, we have a connection.
With this, just know that one of the reasons why the acknowledgement is not turned on with the SYN is because the field that is the acknowledgement number is zero. It's not relevant at this point in time; there's nothing to acknowledge back, and that's the reason why the acknowledgement field is not turned on. Whereas if I look at the sequence number here, the sequence number for this is this very large number here. So when the demo Pi does reply back, it actually knows what the next expected sequence number is, so it has the next expected sequence number, or the acknowledgement number, specified in here. That is the reason why that flag then is turned on, and I can open this up and I can see that the acknowledgement flag is turned on, and that's because this acknowledgement number is relevant at this point in time.
So there's the three-way handshake. The demo laptop says I would like to make a connection with you. The demo Pi says let's make a connection, I'm acknowledging this by having an acknowledgement number of what is the next expected sequence number. And then the demo laptop says great, we have a connection, here is the next sequence number I'm expecting from you.
Then we see the actual data transfer. We have the web page that's requested, and it's requested on this same port — if we scroll through here, 60425 — so it's the same port. This communication happens back and forth.
Then after this is fulfilled, after the demo Pi says okay, I've fulfilled my part of this bargain, it actually closes out. I'm going to scroll down. It actually closes the connection at this point and sends a FIN acknowledgement, so the FIN bit is turned on. That is the demo Pi saying, all right, I'm closing this out. And the demo laptop says great, I acknowledge that you've fulfilled your part of the bargain here.
Now the connection actually stays open at this point. It stays open just in case there's any other communication that needs to happen, any other requests that need to happen. So there is some sort of time in which this connection will stay open.
And then what happened next is I closed the browser. When the browser closed, the demo laptop realizes no, I'm not going to make any more requests, because that browser is not even open. So now I need to terminate this part of the conversation as well. At this point in time the demo laptop makes a request to finish and acknowledge that this port is being closed, that this connection is being closed, and then the demo Pi acknowledges that that connection is being closed.
So there are two parts to this, and it ends up being a back and forth of four different packets that transfer back and forth to disconnect, or to terminate, this connection right here.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →