The lifecycle from closed to established
A TCP connection begins in CLOSED. The client sends a SYN packet and enters SYN-SENT, waiting for the server's response. The server, listening in LISTEN, receives the SYN, sends SYN/ACK, and enters SYN-RECEIVED. The client receives SYN/ACK, sends ACK, and enters ESTABLISHED. The server receives ACK and also enters ESTABLISHED. Both sides can now exchange data. This three-way handshake (SYN, SYN/ACK, ACK) ensures both sides are ready and exchange initial sequence numbers.
Closing and the four-way goodbye
When the client wants to close, it sends FIN and enters FIN-WAIT-1. The server receives FIN, sends ACK, and enters CLOSE-WAIT (the client still might be receiving data). The client receives ACK and enters FIN-WAIT-2. The server sends its own FIN (when done sending data) and enters LAST-ACK. The client receives FIN, sends ACK, and enters TIME-WAIT. The server receives ACK and enters CLOSED. TIME-WAIT delays (typically 2 minutes) prevent old packets from a previous connection with the same IP:port pair from confusing the next connection.
Special states and edge cases
CLOSE-WAIT means the server finished receiving but has not sent its FIN yet. Connections stuck in CLOSE-WAIT indicate the application is not closing the socket. TIME-WAIT connections are closed but kept in the state machine to guard against delayed packets. On high-traffic servers, accumulating TIME-WAIT connections can exhaust the port space. RST (reset) skips the graceful close and immediately moves to CLOSED, used for abrupt terminations or error conditions.