Lion Cipher Lab

See the TCP three-way handshake in Wireshark

• Foundations
• Beginner
• ~35 min
• Free · no account required

Why it matters

Every reliable connection on the internet — every web page, every SSH session, every API call over TCP — starts with the same three-packet ritual: SYN, SYN-ACK, ACK. It is the most common whiteboard question in networking and security interviews, and it is the foundation under a huge amount of attacker and defender behavior: SYN scans, SYN floods, RST injection, and the fact that UDP skips all of it. Watching a handshake you caused, on your own machine, turns a slide diagram into something you actually understand.

What you'll learn

• packet capture
• TCP three-way handshake
• Wireshark display filters
• reading TCP flags and sequence numbers
• recognizing FIN vs RST teardown

Steps in this lab

1. The three-way handshake, in one breath
2. Install Wireshark (from wireshark.org and nowhere else)
3. Start a tiny local server (terminal 1)
4. Start capturing on loopback (before you make the request)
5. Make the connection (terminal 2)
6. Filter to just this conversation
7. Read the flags, sequence, and acknowledgement numbers
8. Watch the connection tear down
9. Why this matters for security — and when the pros skip the scrolling
10. If loopback capture showed nothing (Windows) — and the fallback

Open the full interactive lab →