Question

While reviewing a PCAP in Wireshark, an analyst examines three consecutive TCP packets between a client (10.1.1.50) and a web server (203.0.113.10). Packet 1 has the SYN flag set; Packet 2 has SYN and ACK flags set; Packet 3 has only the ACK flag set. What does this sequence of TCP header flags indicate to the analyst?

Accepted Answer

A successfully completed TCP three-way handshake establishing a connection

Answer

A TCP RST scan being used to enumerate open ports on the server

Answer

A graceful TCP connection teardown initiated by the client

Answer

A half-open SYN flood attack that never completes the connection