Fred is the network administrator for his company. Fred is testing an internal switch. From an external IP address, Fred wants to try and trick this switch into thinking it already has established a…

A packet with both RST and SYN bits set is invalid in TCP - RST resets/tears down a connection while SYN initiates one; this combination is used in some OS fingerprinting scans but does not simulate an established session.

A packet with only the SYN bit set initiates a brand new TCP connection request (the first step of the three-way handshake), which explicitly signals this is a new connection, not an established one.

Setting the ACK bit to zero on a packet to the switch would signal a SYN (new connection initiation) rather than an established session, and using the switch's own source address does not make logical sense for spoofing an external session.

In TCP, the ACK flag is set on all packets after the initial SYN that starts the three-way handshake - meaning ACK is present in every packet of an established session. By sending a packet with the ACK bit set and using his own source address, Fred makes the switch believe it is receiving a continuation packet from an already-established session, which is the basis of TCP session spoofing and blind session hijacking techniques. The switch, seeing a packet with ACK set, may process it as belonging to an existing connection rather than a new unauthenticated request.