This is where it got a bit tricky. When two systems are establishing an initial connection over TCP, a series of packets are sent back and forth to create a "session" between them. This is called a "three-way handshake." During the handshake, the target system transmits a packet back to the machine trying to establish the connection. Because the targeted server believes it’s responding to the real system’s request to establish a connection, the handshake process fails because the attacker’s system never receives the packet to complete the three-way handshake.