How the TCP three-way handshake works

The TCP handshake takes place along the transport or network path. Separate the local socket, IP delivery, TCP or UDP behaviour, firewall filtering and NAT. A successful ping does not prove a TCP port is reachable, and an open port does not prove the application protocol is healthy.

How to find where the connection stops

Work from near to far: process and bind address → host firewall → route → NAT/port forwarding → CGNAT or ISP filtering → external test. For packet-size failures, consider MTU and Path MTU Discovery separately. Always interpret a port number together with its transport protocol.

The detail that matters

SYN followed by SYN-ACK proves more than simple IP reachability; ACK completes establishment. RST and retransmission timeouts point to different failure modes, and stateful firewalls can reject packets that do not belong to expected connection state. To check the connection from outside your local setup, use 2ip port checker.