Three-way handshake
- Client → SYN — proposes connection, initial sequence number.
- Server → SYN-ACK — acknowledges, responds with its ISN.
- Client → ACK — connection established.
SYN floods are a classic DoS: servers must defend with SYN cookies or rate limits at the edge — know the term, not the kernel implementation.
Teardown that matters in incidents
Graceful close: FIN → ACK → FIN → ACK, with TIME_WAIT on the side that initiated close (waits ~2× MSL for stray packets). High-churn clients can exhaust ephemeral ports in TIME_WAIT.
RST aborts immediately — often means a firewall, LB, or crashed process killed the socket. CLOSE_WAIT pileups mean your app isn't closing sockets after the peer closed — an application bug, not "the network."
Reliability mechanics (verbal depth)
- Sequence numbers + ACKs — receiver confirms what it got; sender retransmits gaps.
- Flow control — receive window tells sender how much buffer space remains (receiver-driven).
- Congestion control — sender backs off when it infers network congestion (packet loss or delay). Classic TCP: slow start → congestion avoidance → fast retransmit on duplicate ACKs.
You don't need to derive the math — explain why a lossy link kills throughput and why bulk transfers behave differently from latency-sensitive RPCs.
Head-of-line blocking at TCP
If segment 2 is lost, segment 3 can't be delivered to the application until 2 is retransmitted — even though 3 arrived. This is transport-layer HOL blocking; HTTP/2 still suffers from it on a single TCP connection (which motivated QUIC).
Senior signal
Connect TCP behavior to symptoms: retransmits → latency spikes; zero window → slow consumer; SYN retransmits → firewall or wrong port; TLS works but HTTP hangs → likely not TCP at all.
Further Reading
- Kurose & Ross, 8th Ed — Ch. 3 §3.5.1, §3.5.6 (pp. 227–229, 249–254): TCP connections and connection managementBook25m
- Kurose & Ross, 8th Ed — Ch. 3 §3.6.1, §3.7.1 (pp. 262–275): congestion causes and classic TCP congestion controlBook20m
- High Performance Browser Networking — Transport Layer Security primer (skim TCP section for interview framing)Article20m
Hands-On Tasks (Optional)
Low-setup exercises you can run locally or on a free-tier cloud account. No autograding — the goal is to build intuition, not pass a test.
- See a TCP handshake with curl -v15m
Run `curl -v https://example.com` and identify where DNS, TCP connect, and TLS handshake appear in the output. Optional: capture with Wireshark if you already use it — not required for interview prep.