I'm thinking of a situation where an attacker manipulates a SYN packet that was sent from A's source IP address to B.

The server will receive the packet and think it's a legitimate packet, and send a SYN/ACK packet as a response to B instead of A.

Upon receiving a SYN/ACK packet from a server, as B, what would send back? Would it send RST packet to indicate that it's an error? or SYN/ACK packet thinking a server is trying to establish a connection?

I'm trying to think what would an attacker gain from this type of attack..

This is not a homework. It's just my curiosity as I begin to learn this TCP/IP connection establishment.

  • Welcome to ServerFault. We like folks trying to learn, but on-topic questions here are supposed to be in a professional context which isn't clear here.
    – chicks
    Jan 20, 2017 at 13:36
  • maybe networkengineering.stackexchange.com would be closer.
    – chicks
    Jan 20, 2017 at 13:37
  • It depends on the operating system, if a service is listening on that port, local firewall rules, hardware firewalls, and finally how the syn/ack is constructed. FWIW, nmap has this capability. Jan 20, 2017 at 21:38

1 Answer 1


If a session does not exist for the source/destination pair, the packet will not be accepted by B. In the case of a SYN-ACK packet, B will reply with a RST (reset) packet, telling the server that no connection was initiated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.