Exercise 1: TCP Connect Scan vs. SYN Scan, and net1-7's Three-Way Handshake — Possible Solution
====================================================================

WHAT NET1-7 ESTABLISHED
------------------------------
net1-7 covered TCP's three-way handshake in full: the client sends a
SYN, the server responds with a SYN-ACK, and the client completes the
exchange by sending a final ACK — only after all three steps does a
real, established TCP connection exist.

HOW A TCP CONNECT SCAN USES THE FULL HANDSHAKE
------------------------------
Per this chapter, a TCP Connect scan "completes a full connection via
the OS's own networking stack" — meaning it carries out all three
steps of net1-7's own handshake, ending with a genuinely established
connection, the same as any normal application would.

HOW A SYN SCAN DELIBERATELY STOPS SHORT
------------------------------
Per this chapter's own tip-box, "a SYN scan uses exactly that same
exchange, but stops after step two: it sends the SYN, reads whether a
SYN-ACK comes back... and then sends an RST instead of the final ACK,
rather than ever completing the handshake." The scan gets the
information it needs (whether a SYN-ACK came back, meaning the port
is open) from step two alone, and deliberately never performs step
three of net1-7's own handshake.

WHY THIS MAKES A SYN SCAN "STEALTHIER"
------------------------------
Per this chapter, "many logging systems only record fully-established
connections." Because a SYN scan never actually completes the
handshake, no real connection is ever established at the application
level — from the target's perspective, nothing that many logging
mechanisms treat as a "connection" ever actually happened, even
though the target's TCP stack did briefly respond to the SYN. A TCP
Connect scan, by contrast, completes the handshake fully and
establishes a real connection every logging mechanism is likely to
record.

WHY THIS WORKS AS AN ANSWER
------------------------------
It explains both scan types in terms of exactly which steps of
net1-7's own three-step handshake each one performs, and connects the
stealth difference directly to the chapter's own stated reason
(logging systems recording only fully-established connections) rather
than a vague "SYN scans are quieter" claim.