Which of the following refers to a condition in which a hacker sends a bunch of packets that leave TCP ports half open?

Spoofing refers to falsifying a source IP or identity and is often used as a component within a SYN attack, but it is not itself the attack that causes half-open TCP connections.

Hacking is a broad and non-specific term that does not describe any particular technique involving TCP half-open connections.

In a SYN flood attack, the attacker sends many TCP SYN packets, often with spoofed source IPs, causing the server to allocate resources and send SYN-ACK responses that are never acknowledged. This fills the server's connection backlog with half-open TCP connections, effectively denying service to legitimate users. The defining characteristic is the deliberately incomplete three-way handshake resulting in half-open ports.

A PING (ICMP Echo) attack uses ICMP packets, not TCP, and does not involve the three-way handshake or half-open port states.