Four levels
- Open: the three-way handshake, all three segments.
- Send data: data both ways, and acknowledgements that count bytes.
- Close: FIN, ACK, FIN, ACK, through FIN-WAIT, CLOSE-WAIT, LAST-ACK and TIME-WAIT.
- When it goes wrong: a port with nothing listening, a lost SYN-ACK, a lost data segment.
Every round deals new starting numbers, and the lab remembers your level and the round you are in. After two wrong tries on a segment you can ask for the answer, but the round will say so.
Why three, and not two
Both directions of a TCP connection are independent, and each one needs a starting sequence number that the other side has confirmed it received. That is four things to say: the client’s SYN, the server’s acknowledgement of it, the server’s SYN, and the client’s acknowledgement of that. The handshake is three segments rather than four only because the server folds two of them into one, which is why the middle segment carries both flags at once. Two segments would leave one direction unconfirmed, and the sender would have no way of knowing whether its own starting number ever arrived.
The arithmetic people get wrong
An acknowledgement number does not name the last byte received; it names the next byte expected. A SYN carries no data at all, yet it still consumes one sequence number: that is what makes it reliable, because a segment that occupies no space in the stream could never be retransmitted and confirmed. So a SYN sent with seq=1000 is acknowledged with ack=1001, and the sender’s own next segment starts at 1001 too. The same rule applies to FIN at the other end of the connection’s life. Data is different only in size: 300 bytes sent at seq=1001 are acknowledged with ack=1301, and a plain ACK with no data uses no number at all.
Learn the idea behind the lab
This lab is the practice; The TCP/IP Stack explains where TCP sits, and Packet Inspector shows you the bytes these flags actually occupy.