At a logistics hub, a UDP header shows destination port 53 and a short length, and the capture has no handshake for that flow. Why is the missing handshake normal?
Select an answer to reveal the explanation.
Short Explanation
A postcard does not shake hands before it arrives. You are looking at UDP, which sends the datagram without a SYN or an ACK. The trap is blaming a lost SYN, a stripped ACK, or a rule that DNS cannot ride on UDP.
Full Explanation
UDP is connectionless. It does not perform the TCP three-way handshake, so a UDP datagram has no SYN and no ACK to find in the capture. Destination port 53 is the ordinary DNS query port, and DNS queries commonly travel in a short UDP datagram. The missing handshake is normal because "UDP does not use a handshake, so a short query to port 53 can appear with no SYN and no ACK". "The capture dropped the opening SYN, hiding a handshake this UDP exchange still required" assumes a TCP handshake that UDP does not start, so there is no SYN for the capture to have dropped. "The hub firewall removed the ACK, leaving a UDP query that should have finished a handshake" assumes an ACK that this transport does not use. "DNS is unable to use UDP, so port 53 traffic must display a completed handshake in the capture" is false as a rule, because DNS queries do use UDP on port 53. Exam caveat: some DNS exchanges use TCP, and that fact still does not create a handshake on a packet whose transport is UDP. Operational check: confirm the IP protocol is UDP and the destination port is 53, then read the query in the payload if you need the name, without reconstructing a TCP handshake.