How many packets are exchanged in the TCP three-way handshake?

This looks like a giveaway — "three-way" is right there in the name — which is precisely why interviewers use it as a sanity check. The catch is the four-packet answer, which sounds rigorous because it counts each SYN and each ACK separately.

The three packets

1. SYN — the client picks an initial sequence number and sends a segment with the SYN flag set to request a connection.
2. SYN-ACK — the server responds with a single segment that has both the SYN and ACK flags set. It acknowledges the client's sequence number and sends its own initial sequence number at the same time. This is the key insight: two logical jobs, one packet.
3. ACK — the client acknowledges the server's sequence number. The connection is now established and data can flow.

Why not four

The reason it is not four is that TCP piggybacks the server's SYN onto its ACK. There is no rule forcing them into separate segments, and combining them saves a round trip. The "four-packet" distractor is the trap for people who over-think the symmetry. The FIN distractor confuses connection setup with teardown — teardown is a separate sequence (commonly four packets: FIN, ACK, FIN, ACK).

The security tie-in

A SYN flood abuses step 2: the attacker sends many SYNs and never sends the final ACK, exhausting the server's half-open connection table. Mentioning this shows you understand the handshake, not just its packet count.

What interviewers look for

"Three," the SYN-ACK-is-one-packet explanation, and bonus awareness of SYN floods or the teardown sequence.