TCP Three-Way Handshake Replay Workout (NET-101 Week 6)

This is a Tier-1-graded worksheet. Submit this filled worksheet only. The Tier-2 manual table-fill lab (Lab 6-1) is the deeper artifact; today is the annotated calibration that prepares you for it. After you finish this worksheet, Lab 6-1 will feel like recognition rather than discovery.

Purpose

Week 6 §2 introduced the arithmetic that drives every TCP connection (SYN consumes one sequence number; ACK = peer's ISN + 1). Week 6 §3 introduced the three packets that negotiate the connection (SYN, SYN-ACK, ACK). Week 6 §5 introduced the state machine each endpoint walks (CLOSED / LISTEN / SYN_SENT / SYN_RCVD / ESTABLISHED). Today's worksheet drives the TCP handshake replay panel in pcap-tools over the fundamentals-tcp-3way.pcap fixture so you can see all three play out at once.

The replay panel pairs the standard pcap-tools 3-pane view (packet table + protocol-tree + hex) with four extras: step controls, a client/server state-pill display, authored callout text per step, and a monospace arithmetic box showing the ack = peer_ISN + 1 derivation in real values. Clicking Step forward advances the underlying packet selection, so the protocol-tree and hex panes follow along. You use those affordances to answer two kinds of question this worksheet poses: predictive (what flags will be set on packet 2? what ACK value should it carry?) and observational (the state pills now read SYN_SENT and SYN_RCVD; what packet was just played, and what is each side waiting for?).

The pedagogical claim of Week 6 §2-3 is that the handshake is purely arithmetic and state: three packets, two ISNs, two endpoints moving through a small number of named states. The replay makes that claim visual: the same three numbers (0xa1b2c3d4 and 0x55667788 from the lecture worked example) carry through every panel; the state pills flip exactly when the lecture says they should. The pedagogical claim of §5 is that the state asymmetry between the two endpoints is why the third packet exists. The replay surfaces the asymmetry directly: after step 2 the client reaches ESTABLISHED but the server is still in SYN_RCVD, waiting.

The deeper purpose: this worksheet calibrates your mental model of the handshake against the canonical packet sequence. Lab 6-1 will hand you the same capture and ask you to fill in the fields by eye; if today's calibration sticks, Lab 6-1 is a recognition exercise rather than a discovery exercise. Forward into Week 7 (sliding windows + flow control), the same window-size and MSS fields you observe here drive every later TCP scenario.

Learning Objectives

By the end of this worksheet, you will be able to:

1. Identify the TCP flag set on each of the three handshake packets (SYN only; SYN and ACK; ACK only) and explain why each combination is correct (Apply; Week 6 §3).
2. Verify the acknowledgment-number arithmetic that ACK in packet 2 = client ISN + 1 and ACK in packet 3 = server ISN + 1, using the actual fixture values (Apply; Week 6 §2).
3. Name both endpoints' TCP state after each packet plays and explain the SYN_RCVD-after-step-2 asymmetry that motivates the third packet (Analyze; Week 6 §5).
4. Distinguish the two independent byte streams established by the handshake (client-to-server and server-to-client) and explain why each carries its own ISN (Analyze; Week 6 §2).
5. Articulate one observation about the handshake that the static sequence diagram (Week 6 Figure 6.1) could not surface, in 3-5 sentences (Evaluate; replay-vs-static-diagram distinction).

Equipment Checklist

• Modern web browser (Chromium-family preferred)
• pcap-tools URL open: https://virtuscyberacademy.org/pcap-tools/
• NET-101 Week 6 prose re-read through Section 5
• Week 6 Figure 6.1 (TCP handshake sequence diagram) visible in a second browser tab for comparison
• Paper notebook for predictions (do NOT click Step before you predict)
• Lab 5 (UDP / DNS / DHCP) submitted PASS

Step-by-Step Procedure

This worksheet takes ~60 minutes. Plan one sitting.

Stage 1 - Load pcap-tools and pick the fixture

• Step 1. Open pcap-tools at the URL above. Confirm you see the curated-capture dropdown, the packet-table pane, the protocol-tree pane, and the hex pane.
• Step 2. From the curated dropdown, pick fundamentals-tcp-3way.pcap (manifest id net-101-fund-tcp-3way). The packet table fills with three rows. The replay panel mounts above the standard 3-pane view because the manifest entry carries a replay_mode field.
• Step 3. Confirm the replay panel shows: step controls (Start / Previous / Next), a state pill display reading Client: CLOSED and Server: LISTEN, a callout text area, and an arithmetic box. The packet table currently has no row selected.

Stage 2 - Predict the handshake before stepping

Before you click any Step button, fill the prediction columns in Tables A, B, and C from the Week 6 prose alone. The replay will then either confirm or correct each prediction.

• Step 4. From Week 6 §3 (the three-way handshake): predict the flag set on each of the three packets. Fill the "Predicted flags" column in Table C for all three rows.
• Step 5. From Week 6 §5 (the state machine): predict the client and server state after each packet plays. Fill the "Predicted client state" and "Predicted server state" columns in Table B for all four rows (initial + after each of 3 packets).
• Step 6. From Week 6 §2 (the arithmetic): the client's ISN is 2712847316 (0xa1b2c3d4); the server's ISN is 1432778632 (0x55667788). Predict the seq and ack values on each packet. Fill the "Predicted seq" and "Predicted ack" columns in Table A. Hint: the ACK arithmetic is peer_ISN + 1 (the SYN that consumed one sequence number).
• Step 7. Stop before stepping. Photograph or scan your paper predictions if your grader requires evidence the predictions came first. Predictions made after stepping have lost their calibration value.

Stage 3 - Step through the replay

• Step 8. Click Start replay (or Next from the initial state). The replay advances to step 1: the SYN packet. Observe the state pills, the callout text, the arithmetic box, and the packet-table selection (row 1 is now highlighted). Fill the Observation columns of row 1 in Tables A, B, C. Fill row 1 of Table D with the callout's first sentence reproduced verbatim.
• Step 9. Click Next. The replay advances to step 2: the SYN-ACK packet. The client state pill flips to ESTABLISHED; the server pill stays at SYN_RCVD. Fill the Observation columns of row 2 in Tables A, B, C. Fill row 2 of Table D with the callout's first sentence reproduced verbatim. Note the asymmetry: the client is "done" but the server is still half-open. Reflection 3 picks this up.
• Step 10. Click Next. The replay advances to step 3: the ACK packet. The server pill flips to ESTABLISHED. Fill the Observation columns of row 3 in Tables A, B, C. Fill row 3 of Table D with the callout's first sentence reproduced verbatim.
• Step 11. Click Next once more. The replay shows the summary screen ("Handshake Complete"). Fill Table E with the four summary values the screen lists.

Stage 4 - Verify the arithmetic by hand

• Step 12. With Table A filled, compute by hand: 2712847316 + 1 = ? Confirm this matches the ack value in row 2 of Table A. Confirm 1432778632 + 1 = ? matches the ack value in row 3. Mark "match" or "miss" per row in Table A's Match column. Misses surface as either an arithmetic error in your prediction or a fixture value you mis-read; the replay panel's arithmetic box is the authority.
• Step 13. Hex sanity check. Click on row 1 of the packet table; expand the TCP section in the protocol-tree pane; locate the sequence-number field. The protocol-tree shows 2712847316 in decimal; the hex pane shows the four bytes a1 b2 c3 d4 (big-endian on the wire). Confirm. Repeat for the ACK number on row 2: the protocol-tree shows 2712847317; the hex pane shows a1 b2 c3 d5. The one-bit difference between the two hex strings is the +1 arithmetic made byte-level.

Stage 5 - Replay the edge cases

• Step 14. Click Previous to back up to step 2. The state pills flip back: client returns to SYN_SENT, server to SYN_RCVD. Observe: the callout text and arithmetic box revert too. This is the affordance that makes the replay a teaching tool rather than a one-shot animation. The state asymmetry from Step 9 is now visible from the previous step; you can scrub forward and back.
• Step 15. Click Replay (or the "Start" / "Reset" control) to return to the initial state (Client: CLOSED, Server: LISTEN). The packet-table selection clears; the callout reads "TCP Three-Way Handshake -- Ready". This is the state your peer's connection will be in next time sshd starts on a fresh server.

Stage 6 - Reflection

Answer the 5 reflection prompts below in 2-4 sentences each.

Data Entry Tables

Table A - SEQ and ACK Arithmetic per Packet (Steps 6, 8-12; PREDICT before stepping)

Arithmetic verification (hand-compute):

• 2712847316 + 1 = ___________ → matches packet 2's ACK? [ ] Yes [ ] No
• 1432778632 + 1 = ___________ → matches packet 3's ACK? [ ] Yes [ ] No

Table B - Client + Server State per Step (Steps 5, 8-10; PREDICT before stepping)

State-asymmetry observation. Looking at the row "after packet 2 (SYN-ACK)" above: the client state and the server state disagree. One sentence: which one is further along, and why?

Table C - TCP Flag Set per Packet (Steps 4, 8-10; PREDICT before stepping)

(Hint: tcp.flags is a 9-bit field. SYN occupies bit 1 (value 0x002); ACK occupies bit 4 (value 0x010). A packet with SYN and ACK both set has tcp.flags = 0x012.)

Table D - Callout-Text Reproduction (Steps 8-10; transcribe the first sentence verbatim)

(Transcribing the first sentence forces a second pass through the prose. The reflection prompts below assume you have done this.)

Table E - Summary Screen (Step 11)

Verification. The "Client -> Server stream starts at" value should equal client ISN + 1. Confirm: 2712847316 + 1 = ___________ matches the value above. [ ] Yes [ ] No

Reflection Prompts

Answer in 2-4 sentences each.

1. The brief's headline question for this lab. In packet 2, the ACK field reads 2712847317, which is the client's ISN plus one. What does that +1 tell you about the payload size of packet 1 (the SYN)? (Hint: ACK numbers point at "the next byte expected". If the SYN packet carried zero application bytes but the ACK still advances by 1, what does that say about how SYN itself participates in the byte stream?)

2. If the SYN-ACK is lost in transit, what happens next? Walk through the retransmission timing. (Hint: the client is in SYN_SENT waiting for the SYN-ACK. The server is in SYN_RCVD holding a half-open entry. One side will time out and retry. Which side, on what timer, and for how many retries?)

3. Why does the server acknowledge the client's SEQ in the same packet as its own SYN, rather than sending two separate packets (one ACK, then one SYN)? (Hint: TCP could in principle have a four-way handshake (SYN, ACK, SYN, ACK). Why is the three-way version preferred? Think about latency and the "half-open connection" terminology.)

4. Table B row 3 ("after packet 2") shows the state asymmetry explicitly: the client is in ESTABLISHED but the server is still in SYN_RCVD. When is the handshake "done" from the client's view versus the server's view? (Hint: the asymmetry lasts exactly one round-trip. What event closes the gap, and what would happen to the server if that event never arrived?)

5. The static sequence diagram from Week 6 Figure 6.1 is the same three-packet exchange as this replay. Name one specific observation the replay surfaced that the static diagram could not. (Hint: a static diagram has to show all three packets at once, with all state labels visible. The replay shows them one at a time, with the previous state still visible from before the click. A good answer names a specific dynamic property: the timing of a state transition, the direction of a transition, the moment an asymmetry appears, or the byte-level hex pattern that the +1 arithmetic produces.)

Tutor Hint Surface

If you get stuck on a step, the academy tutor at /tutor/ knows the context of this replay. Ask the tutor:

• "What does the +1 in packet 2's ACK mean?" - the tutor will walk you through the SYN-consumes-a-sequence-number arithmetic.
• "Why is the server still SYN_RCVD after step 2?" - the tutor will distinguish "the server sent its SYN-ACK" from "the server received the third ACK".
• "What is the difference between this replay and the manual lab 6-1?" - the tutor will explain that Lab 6-1 uses the same fixture but asks you to find the fields without the callouts.

The tutor is a calibration aid, not a substitute for stepping through the replay yourself.

Submission Checklist

• This worksheet, with Tables A, B, C, D, E filled
• All 5 Reflection Prompts answered
• Prediction columns in Tables A, B, C filled BEFORE the Observation columns (or honest acknowledgement if not)
• Table A arithmetic verification done by hand (with the + 1 computations shown)
• Table B state-asymmetry observation written in one sentence
• Toolchain Diary entry for pcap-tools replay panel added

Pass/Fail Self-Evidence (Tier 1 of the rubric)

Every gate must be checked.

• Gate 1. Predictions in Tables A, B, C filled before observations.
• Gate 2. Table A's row 2 ACK matches client_ISN + 1 = 2712847317.
• Gate 3. Table A's row 3 ACK matches server_ISN + 1 = 1432778633.
• Gate 4. Table B's "after packet 2" row shows the client at ESTABLISHED and the server at SYN_RCVD (the asymmetry).
• Gate 5. Reflection 5 (the replay-vs-static-diagram question) names a specific dynamic property the replay surfaced.

If any gate is unchecked, do not submit yet.

Common Pitfalls

The five most common first-attempt failures:

1. Stepped before predicting. Tables A, B, C lose their calibration value once predictions are back-filled. If you stepped first, redo with a sibling fixture (any other TCP capture in pcap-tools) where the ISN values are different but the +1 arithmetic is the same.
2. Confused tcp.flags hex. SYN alone = 0x002; ACK alone = 0x010; SYN+ACK together = 0x012. The bit positions are SYN at bit 1 and ACK at bit 4. A SYN+ACK packet is not 0x020 or 0x011; it is 0x012.
3. Treated the server as ESTABLISHED after step 2. The asymmetry is the whole point of this exercise. The server transitions to ESTABLISHED only after step 3 (when it receives the ACK). The replay panel shows this; Table B confirms it.
4. Misread big-endian on the wire. The hex pane shows a1 b2 c3 d4 for the client ISN; this is the four bytes in network byte order (big-endian). The decimal value 2712847316 is what the protocol-tree pane parses. Both representations describe the same number.
5. Skipped the callout text. Table D forces a re-read of the first sentence of each callout. The reflection prompts assume the student has read all three; if you skipped them, Reflections 1, 3, and 4 will feel harder than they should.

Forward Pointer

Lab 6-1 (TCP three-way handshake; manual table-fill) uses the same fixture. Lab 6-1 asks you to find the field values without callouts; today's worksheet is the calibration that makes that exercise quick. After today, Lab 6-1 should take less than 30 minutes.

Lab 6-2 (TCP connection teardown) covers the FIN-WAIT / TIME-WAIT / CLOSE-WAIT states that this replay deliberately omits (the handshake is just the opening; teardown is its own arc). Lab 6-2 uses a different capture; the state-machine reading skill you built today carries forward.

Week 7 (TCP II: sliding windows and flow control) uses the MSS and window-size fields you observed in Tables E and (implicitly) in the per-packet detail panes. The 1460-byte MSS and the 64240 / 65535 windows are the load values that drive every later TCP scenario.

NET-101 capstone (Network Snapshot report) asks you to write a one-page protocol analysis of a real capture you collect on your own machine. The skill of stepping through a capture one packet at a time with state-machine awareness is the foundation of that report.

Beyond NET-101: the same step-through-with-state pattern transfers to:

• PEN-101 + WIR-101 captures (you watch a connection being established under different network layers)
• RE-101 SB6141 firmware analysis (you watch a TR-069 management session play out one packet at a time)
• SEC-101 Lab 6 STRIDE threat modeling (you trace a real connection from the attacker's perspective and identify the spoofing / tampering / information-disclosure surfaces)

LAB WORKSHEET COMPLETE - TCP Three-Way Handshake Replay Workout v1.0; Tier-1-graded worksheet-completion; YAML frontmatter (12 fields incl grading_disposition: Tier-1 worksheet-completion. every prediction row in Tables A through C filled BEFORE the corresponding observation row; Tables D and E filled accurately against the replay panel; all 5 reflection prompts answered) + 5 Bloom-ordered LOs tied to NET-101 Week 6 §2 sequence-number arithmetic + §3 three-way handshake + §5 state machine + replay-vs-static-diagram distinction + 6-item Equipment Checklist (incl pcap-tools URL + fixture identity + Week 6 prose re-read + Figure 6.1 visible + paper-notebook-for-prediction discipline + Lab 5 PASS gate) + 6-stage / 15-step Procedure (load pcap-tools + pick fundamentals-tcp-3way fixture + confirm replay panel mounts -> predict flag sets / states / arithmetic for all 3 packets BEFORE stepping -> step through SYN -> step through SYN-ACK -> step through ACK -> reach summary screen -> verify arithmetic by hand including hex byte-level confirmation -> replay backward / reset to see edge affordances -> reflect) + 5 Data Tables (A: seq/ack arithmetic predict-then-verify with hand-computed +1 verification rows / B: client+server state pairs predict-then-verify with state-asymmetry one-sentence observation / C: TCP flag sets predict-then-verify with hex value column / D: callout-text reproduction first-sentence transcription / E: summary-screen 5-row reproduction) + 5 Reflection Prompts (the +1 in SYN-ACK ACK tells you what about SYN payload size + retransmission timing if SYN-ACK is lost + why ACK + own SYN combined in one packet instead of four-way + when is handshake done from client vs server view asymmetry one-round-trip apart + the brief's headline what-did-you-see-with-replay-not-with-static-diagram) + Tutor Hint Surface section (3 example questions the tutor knows context for) + Submission Checklist (6 items) + Pass/Fail Self-Evidence (5 Tier-1 gates) + Common Pitfalls (5 numbered incl tcp.flags hex confusion + treating server as ESTABLISHED prematurely + big-endian wire format misread) + Forward Pointer to Lab 6-1 (manual table-fill uses same fixture; today is calibration) + Lab 6-2 (teardown; different capture; state-machine skill transfers) + Week 7 (MSS + windows drive every later scenario) + NET-101 capstone (Network Snapshot uses step-through-with-state skill) + PEN-101 + WIR-101 + RE-101 SB6141 firmware + SEC-101 Lab 6 STRIDE transfers; references the interactive lab spec at courses/net-101/labs/lab-tcp-handshake-replay.md (engineering commit 2f085e4; hand-back 436813c); fixture identity net-101-fund-tcp-3way per manifest v6; tutor overlay at pcap-tools/backend/tutor/prompts/overlays/tcp-3way-replay-context.md is the hint-surface anchor; static-diagram counterpart at assets/diagrams/net-101-tcp-handshake.svg (visual-learner memo §3 #2); editor-guide-clean: 0 em-dashes, 0 phrase-blacklist hits per spec.