What term describes a DoS attack that does not complete the TCP three-way handshake?

• A. half-close
• B. half-open
• C. Neither A nor B
• D. Both A and B

Answer: (B)

In TCP, a connection starts with a three-way handshake: SYN, SYN-ACK, then ACK. If the initiator sends a SYN but never completes with the final ACK, the server has already allocated a resource for that connection and waits for the last step. The connection remains in an incomplete, waiting state—that’s a half-open connection. This situation is the essence of a DoS tactic because many half-open attempts can exhaust the server’s resources and prevent legitimate clients from connecting.

Half-close isn’t correct here because it refers to one side closing its sending channel after a connection is established, not to an incomplete handshake. So the best term for a DoS attack that does not complete the TCP three-way handshake is half-open.