'%20stroke-width='24'%20stroke-linecap='round'%20stroke-linejoin='round'%3e%3cpath%20d='M196%2058%20C196%2042%20184%2032%20168%2032%20H112%20C84%2032%2062%2054%2062%2082%20C62%20108%2082%20126%20110%20126%20H148%20C176%20126%20194%20144%20194%20170%20C194%20198%20172%20224%20144%20224%20H88'/%3e%3c/g%3e%3ccircle%20cx='196'%20cy='58'%20r='14'%20fill='%236366F1'%20stroke='%23FFFFFF'%20stroke-width='6'/%3e%3ccircle%20cx='88'%20cy='224'%20r='14'%20fill='%23EC4899'%20stroke='%23FFFFFF'%20stroke-width='6'/%3e%3ccircle%20cx='62'%20cy='82'%20r='14'%20fill='%238B5CF6'%20stroke='%23FFFFFF'%20stroke-width='6'/%3e%3cpath%20d='M121%20102%20L121%20150%20L160%20126%20Z'%20fill='%23FFFFFF'%20opacity='0.98'/%3e%3c/svg%3e){kind=small}
Quick reference · Interview Q&A, cheat sheet & quiz
TCP Interview & Revision
Fast recall material for interviews and refreshers — representative questions, a compact mental model, and a quick quiz.
Mangesh MandlikLast updated:
01 · Interview Questions
Interview Questions
Representative TCP interview questions, with the shape of a strong answer.
Why does the handshake need three messages, not two?
Because both sides must independently prove they can both send AND receive — two messages only prove one direction of connectivity. The handshake also lets both sides agree on initial sequence numbers and rejects stale duplicate SYNs.
What's the difference between flow control and congestion control?
Flow control is receiver-driven and protects the receiver's buffer (rwnd). Congestion control is sender-driven and self-imposed, protecting the shared network (cwnd).
Why does TCP use cumulative ACKs?
So a single ACK can confirm many segments at once, and so that losing one ACK is usually harmless — the next ACK re-confirms everything.
What happens during Slow Start vs Congestion Avoidance?
Slow Start grows cwnd exponentially (roughly doubling per RTT) until ssthresh is reached; Congestion Avoidance then grows it linearly (+1 per RTT) to probe capacity cautiously.
Why does closing a connection need four messages?
Because TCP connections are full-duplex and each direction closes independently — a FIN only closes the sender's half; the other side may still have data to send.
Why does TIME_WAIT exist?
To ensure any delayed duplicate segments from the just-closed connection expire before the same 4-tuple (source/dest IP+port) can be reused by a new connection.
02 · Revision Notes
Revision Notes
The core mental model, condensed.
TCP = reliable, ordered byte stream over unreliable IP while the connection stays established. Established via a 3-way handshake (SYN, SYN-ACK, ACK). Every byte is sequence-numbered; receivers cumulatively ACK, meaning the ACK confirms bytes reached the peer's TCP stack, not that the application processed them. Loss triggers retransmission (timeout or 3 dup ACKs → fast retransmit). Throughput is governed by min(cwnd, rwnd) — cwnd grows via Slow Start (exponential) then Congestion Avoidance (linear). Closing is a 4-way FIN/ACK/FIN/ACK exchange, followed by TIME_WAIT on the active closer.
03 · Quiz
Quiz
Test your recall — answers are in the callouts below, not shown until you check.
Q1. What does an ACK for byte 501 actually confirm?
That every byte up to (but not including) 501 has been received — cumulative acknowledgement, not just byte 500 alone.
Q2. A sender has cwnd=8 MSS and the receiver has advertised rwnd=3 MSS (both expressed in segments for simplicity). How many segments can be in flight?
3 segments — rwnd is really advertised in bytes (here 3 × MSS); the effective window is always the minimum of the two, min(cwnd, rwnd).
Q3. Which recovers faster from a single lost segment: a timeout or 3 duplicate ACKs?
3 duplicate ACKs (fast retransmit) — it does not have to wait for the much longer retransmission timeout to expire.
Q4. Why might a small, latency-sensitive write get delayed by tens of milliseconds (for example ~40 ms in a typical scenario) unexpectedly?
If a small segment is already unacknowledged, Nagle's algorithm may hold the next tiny write until the peer's delayed ACK arrives — a classic source of avoidable latency. Delayed ACK timing depends on the operating system, TCP implementation and connection state. The approximately 40 ms delay shown here is an illustrative scenario, not a universal Linux guarantee; RFC 1122 allows a delayed ACK of up to 500 ms.
Q5. What TCP state does the side that sends the final ACK during connection close enter?
The active closer that sends the final ACK enters TIME_WAIT — it waits roughly 2×MSL before fully releasing connection resources.
04 · Cheat Sheet
Cheat Sheet
One-line facts, ready to recall under pressure.
Handshake
SYN → SYN-ACK → ACK (3 messages, 1 RTT).
Teardown
FIN → ACK → FIN → ACK (4 messages) + TIME_WAIT (~2×MSL).
Effective window
min(cwnd, rwnd).
Congestion control phases
Slow Start (exponential) → Congestion Avoidance (linear) → Fast Recovery (on 3 dup ACKs) / hard reset to cwnd=1 (on timeout).
Flow control vs congestion control
Flow control = receiver protects itself (rwnd). Congestion control = sender protects the network (cwnd).
Nagle fix
TCP_NODELAY disables Nagle's algorithm when latency-sensitive small writes matter more than packet-efficiency.
Key takeaways
- 3-way handshake, 4-way close — memorize the message counts and why they differ (bidirectional proof vs independent half-closes).
- Cumulative ACKs + sequence numbers = the whole reliability story in two ideas.
- cwnd (network) and rwnd (receiver) are independent — the smaller one always wins.
- AIMD (additive increase, multiplicative decrease) is the congestion-control heartbeat: grow cautiously, back off sharply.
- TIME_WAIT is a feature, not a bug — it prevents stray duplicate segments from corrupting a future connection reusing the same 4-tuple.