When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must then

Generating TCP SYN packets with random *destination* addresses would spread the attack across many potential targets, rather than focusing on overwhelming a single victim's connection queue effectively.

An attacker launches a TCP SYN flood by sending numerous SYN packets to the victim server, each with a spoofed or random source IP address. This causes the victim to respond with a SYN-ACK to a non-existent host and allocate resources in its connection queue while waiting for a final ACK that will never arrive, eventually exhausting the queue and denying legitimate connections.

Generating TCP ACK packets from random source addresses would not initiate connections or fill the SYN queue, as ACK packets are part of an already established or expected connection, and systems typically drop ACKs without a prior SYN.

Generating TCP RST packets would terminate existing connections, not exploit the SYN queue or initiate a denial-of-service attack based on the three-way handshake.