The first two steps (SYN and SYN/ACK) are exactly the same aswith a SYN scan. Then, instead of aborting the half-open connectionwith a RST packet, krad acknowledges the SYN/ACK with its own ACKpacket, completing the connection. In this case, Scanme even had timeto send its SSH banner string(SSH-1.99-OpenSSH_3.1p1\n) through the now-openconnection. As soon as Nmap hears from its host OS that the connection wassuccessful, it terminates the connection. TCP connections usually end withanother handshake involving the FIN flag, but Nmap asks thehost OS to terminate the connection immediately with a RSTpacket.