Editing Transmission Control Protocol (section)

===Connection hijacking===
{{Main|TCP sequence prediction attack}}
An attacker who is able to eavesdrop on a TCP session and redirect packets can hijack a TCP connection. To do so, the attacker learns the sequence number from the ongoing communication and forges a false segment that looks like the next segment in the stream. A simple hijack can result in one packet being erroneously accepted at one end. When the receiving host acknowledges the false segment, synchronization is lost.<ref>{{cite web|url=https://www.usenix.org/legacy/publications/library/proceedings/security95/full_papers/joncheray.pdf |author=Laurent Joncheray|title=Simple Active Attack Against TCP |date=1995|access-date=2023-06-04}}</ref> Hijacking may be combined with [[ARP spoofing]] or other routing attacks that allow an attacker to take permanent control of the TCP connection.

Impersonating a different IP address was not difficult prior to {{harvtxt|RFC 1948}} when the initial ''sequence number'' was easily guessable. The earlier implementations allowed an attacker to blindly send a sequence of packets that the receiver would believe came from a different IP address, without the need to intercept communication through ARP or routing attacks: it is enough to ensure that the legitimate host of the impersonated IP address is down, or bring it to that condition using [[denial-of-service attack]]s. This is why the initial sequence number is now chosen at random.