Fred is the network administrator for his company. Fred is testing an internal switch. From an external IP address, Fred wants to try and trick this switch into thinking it already has established a…

The RST flag is used to abruptly terminate an existing connection rather than simulate an established one, and 'SIN' is not a valid TCP flag.

A SYN-only packet initiates a new three-way handshake rather than mimicking an already-established session.

Setting the ACK bit to zero removes the acknowledgment indicator, making the packet resemble a new connection request rather than established session traffic, and using the switch's own address as source is illogical for this spoofing purpose.

In TCP, the ACK flag is present in all packets after the initial SYN to acknowledge received data, indicating a session is already in progress. By sending a packet with the ACK bit set and his own source address, Fred mimics mid-session traffic behavior. This exploits stateless or poorly configured devices that may treat any ACK-flagged packet as belonging to an established connection.