Can someone help me understand pf states (tcp.first, etc.)?

[ryan87]

I'm trying to troubleshoot a connectivity issue where I want to adjust some of the default state timeouts in pfSense, but I don't quite understand what each state is and I haven't been able to find a good explanation online.

I'm specifically interested in TCP and want to increase the timeout for an application opening a connection. The thing I don't understand is when the connection will be in each state; tcp.first, tcp.open, and tcp.established.

I feel like it should be simple, but I asked ChatGPT and, after it told me the earth is flat and the sky is green, I'm confused. If I think of a 3-way handshake, this seems logical to me:

Is that right? If not, what would the state be for each of the steps I've labelled 1-6?

As a follow on question, if I adjust the State timeout in the advanced section of a firewall rule, which timeout is getting changed?