nerdexam
GIAC

GPEN · Question #303

The 3-way handshake method is used by the TCP protocol to establish a connection between a client and the server. It involves three steps: 1. In the first step, a SYN message is sent from a client to

The correct answer is D. 241713112. In the TCP 3-way handshake, the server's SYN-ACK acknowledgment number equals the client's ISN plus one, confirming receipt of the client's SYN segment.

Penetration Testing Foundations & Reconnaissance

Question

The 3-way handshake method is used by the TCP protocol to establish a connection between a client and the server. It involves three steps: 1. In the first step, a SYN message is sent from a client to the server. 2. In the second step, a SYN/ACK message is sent from the server to the client. 3. In the third step, an ACK (usually called SYN-ACK-ACK) message is sent from the client to the server. At this point, both the client and the server have received acknowledgements of the TCP connection. If the Initial Sequence Numbers of the client and server were 241713111 and 241824111 respectively at the time when the client was sending the SYN message in the first step of the TCP 3-way handshake method, what will be the value of the acknowledgement number field of the server's packet when the server was sending the SYN/ACK message to the client in the second step of the TCP 3-way handshake method?

Options

  • A241824112
  • B241713111
  • C241824111
  • D241713112

How the community answered

(42 responses)
  • A
    12% (5)
  • B
    5% (2)
  • C
    10% (4)
  • D
    74% (31)

Why each option

In the TCP 3-way handshake, the server's SYN-ACK acknowledgment number equals the client's ISN plus one, confirming receipt of the client's SYN segment.

A241824112

241824112 is the acknowledgment number the client sends in the third step of the handshake to acknowledge the server's ISN (241824111 + 1), not what the server sends in its SYN-ACK.

B241713111

241713111 is the client's original ISN and cannot serve as the acknowledgment number because TCP requires the ACK field to be ISN+1, not ISN itself.

C241824111

241824111 is the server's own ISN, which appears as the sequence number in the server's SYN-ACK packet, not as the acknowledgment number field.

D241713112Correct

Per RFC 793, when the server receives the client's SYN with ISN 241713111, it sets the acknowledgment number in its SYN-ACK to 241713111 + 1 = 241713112. The increment by one is required because the SYN flag itself consumes one sequence number in the TCP specification. This value informs the client that the server expects to receive data beginning at sequence number 241713112 in the next segment.

Concept tested: TCP 3-way handshake sequence and acknowledgment number calculation

Source: https://www.rfc-editor.org/rfc/rfc793

Topics

#TCP 3-way handshake#sequence numbers#ISN#network protocols

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice