At a manufacturer, a TCP header has SYN set and ACK unset, and the capture has no earlier packet for that 5-tuple. What do those flags mean?
Select an answer to reveal the explanation.
Short Explanation
A raised hand starts the conversation; it does not end one. You are seeing the first SYN of a TCP handshake, with no ACK and no earlier packet on that 5-tuple. The trap is reading those flags as a FIN close, a reset, or an ICMP error.
Full Explanation
A TCP connection starts with a segment that has SYN set and ACK unset. That segment is the client's connection attempt. The server reply would set both SYN and ACK, and later data segments carry ACK. Here ACK is unset, and the capture has no earlier packet for the same 5-tuple, so this is the start of a conversation rather than a continuation. The flags mean "A new connection attempt: SYN is set, ACK is unset, and no earlier packet exists for that 5-tuple". "A graceful close, with FIN asking the peer to finish a session the plant already established" requires the FIN flag on an existing connection, and FIN is not the flag described. "A reset of an old connection, with RST aborting a session the plant host no longer wants open" requires RST, which aborts a session, and the header in the question has SYN set instead. "An ICMP error reporting that the plant destination could not be reached by this packet" would be an ICMP message, a different protocol, not a TCP flag combination. Exam caveat: a lone SYN is still a new connection attempt when it is a scan or a repeat, and the flags alone do not name the application. Operational check: look for the matching SYN-ACK and the completing ACK on that conversation, and confirm the 5-tuple has no prior packet before you call this segment the start.