A user in your department complains about a slow Internet connection. You monitor the external interface of your company's border router and notice an excessive number of half-open TCP connections…

In a TCP SYN flood attack, an attacker sends a large volume of SYN packets to the target without completing the three-way handshake (no ACK is returned). The server allocates resources for each half-open connection and waits for completion, eventually exhausting its connection table and denying service to legitimate users. Monitoring an excessive number of half-open connections directly confirms this attack type.

TCP hijacking involves an attacker taking over an already established TCP session, which would not produce a high number of half-open connections.

A ping flood uses ICMP echo requests to overwhelm a target and would not result in half-open TCP connections on the router.

A brute force attack targets authentication systems by trying many credential combinations and has no relationship to TCP connection states.