TCP Three-Way Handshake
The attacker needs to know the TCP sequence numbers used in the TCP segments so that he can send a properly constructed ACK segment to the destination. If the attacker’s ACK segment reaches the destionation before the originator’s ACK segment does, the attacker becomes trusted by destionation.
