I am currently looking into the TCP/IP stack and analysing packets sent and received by my desktop. I understand the concept of SYN, SYN-ACK, ACK, however after physically looking at some packet data I have a few questions:

Are the properties from the IP such as TTL and window size only set by the client sending the SYN packet? (Does the target host that replies with an ACK set its own properties or use the initial ones set by the sender)


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 19:58
  • TTL is a property of the IP layer: each side sets its own, adjusted by routers en route (RFC 791 p14)
  • Window size is a property of TCP: each side sets its own current acceptable size (RFC 793 p4)

Neither of these is really to do with three-way handshake.

  • Okay thanks for your response. The reason for my question is because I am looking into preventing OS fingerprinting from remote machines, and as I understand it you can determine an OS based on things like the TTL and window size. So I wanted to know whether this would only be a concern if I was sending out SYN packets or whether a remote machine could detect my OS from an ACK that I had sent in response to a SYN. – Will Paul Nov 6 '17 at 13:04
  • Good introductory material is here en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting – jonathanjo Nov 6 '17 at 13:11
  • in three way hand shake 3rd step, what is the sequence number in TCP header? – Manjitha Teshara Aug 2 '18 at 9:15
  • Have a look at this explanation: en.wikipedia.org/wiki/… Ask a new question if that doesn't clear it up for you. – jonathanjo Aug 2 '18 at 9:42

TCP uses athree-way handshaketo open a connection:


Client sends a segment with

– SYN bit set to '1'

– port number of client

– initial sequence number (ISN) of client


Server responds with a segment with

– SYN bit set to '1'

- ACK bit set to '1'

– initial sequence number of server set to sequence number field

-acknowledgement number set to client initial sequence number (ISN) plus one

Step 3:- Client acknowledges by sending a segment with:

– ACK set to '1'

-Acknowledgement number set to server sequence number plus one
  • The question is not about the handshake mechanism, it's about the other properties. – jonathanjo Aug 2 '18 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.