Why is the Initial Sequence Number (ISN) of the first SYN in TCP's three-way handshake considered a security risk?

• A. It's random.
• B. It's a predictable clock-based algorithm.
• C. It's too long.
• D. It's encrypted.

Answer: (B)

Predictable initial sequence numbers open the door for TCP spoofing and session hijacking. If the ISN for the first SYN is generated by a clock-based algorithm, its value advances in a predictable way tied to time. An attacker who can observe traffic or estimate the clock can accurately guess upcoming ISN values, allowing them to forge packets that look like part of a legitimate TCP handshake or data stream. That capability enables spoofed connections to be established or existing ones to be reset or corrupted, which is why clock-based predictability is a security risk. Modern TCP implementations use more randomization to make ISNs hard to predict, reducing this vulnerability.