_________ is a form of Denial of Service attack which interrupts the TCP three way handshake and leaves half open connections.

DNS recursion is a legitimate process for DNS resolution, though it can be abused for amplification attacks, it does not directly interrupt the TCP handshake.

NMAP is a network scanner used for reconnaissance and security auditing, not a denial-of-service attack itself.

A Land attack sends a forged SYN packet with the same source and destination IP address and port, potentially causing older systems to crash, but is distinct from exhausting connection tables with half-open connections like a SYN flood.

A SYN flood attack involves sending a large number of TCP SYN requests to a target server without completing the three-way handshake, exhausting the server's connection resources by leaving numerous half-open connections.

Port scanning is a reconnaissance technique used to identify open services on a host, not a denial-of-service attack.