the initial sequence number
When you start numbering the pages of a brand-new document, you could begin at page 1 every time — but if old and new documents share a desk, identical page numbers cause mix-ups. TCP faces this exact issue, so instead of starting every connection's byte count at 1, each end picks a fresh starting value when the connection opens. That starting value is the initial sequence number (ISN): the stream position assigned to the first byte each side will send.
Each direction of a TCP connection has its own ISN, chosen by that side and announced to the other in the SYN segment of the three-way handshake. The peer acknowledges ISN+1 (the SYN itself logically consumes one sequence slot), and from then on every byte counts up from the ISN. The value isn't a simple 1 or 0; modern stacks choose it in a hard-to-predict way (historically tied to a clock plus randomness) so that two different connections between the same pair of hosts don't reuse the same numbers, and so that an attacker can't easily guess the sequence to forge data into the stream.
Why it matters: the ISN solves two real problems at once. First, it prevents confusion between a new connection and a stale, delayed segment from an old connection between the same endpoints — without distinct starting numbers, a wandering old packet could be mistaken for new data. Second, randomizing it is a modest security measure against off-path injection and connection-hijacking attacks. This is also exactly what the handshake 'synchronizes': SYN means 'here is my ISN; please line your counting up with mine.'
Your side opens with SYN, seq=2,938,471,002 — that's your ISN. The server acknowledges 2,938,471,003 and announces its own ISN in the SYN-ACK. From there, your first real data byte is 2,938,471,003, not byte 1.
Each direction starts at its own randomized ISN, not at 1.
Predictable ISNs were a real vulnerability: an attacker who could guess them could inject or hijack a connection without seeing the traffic. Randomizing the ISN is now standard, but it complements, not replaces, real security like TLS.