How does leaving a TCP connection half-open makes SYN and SYN+ACK stealth and absent from the logs?

Question

I was studying about TCP SYN (stealth) scan which involves carrying out port scan while avoiding detection. I also read that it is similar to TCP connect scan except that the last ACK packet is replaced by the RST packet. I am unable to understand why this replacement of ACK with RST makes TCP SYN scan stealth. According to me the target systems can easily record the attacker's IP address as soon as it receives SYN packet.

On searching the web, the only relevant result I got was what is the difference between open TCP scan and half-open (stealth) TCP scan? On this also, it was only mentioned that lack of ACK packet makes the connection stealth. But it doesn't explains how.

My question

How does lack of ACK packet makes the first two phases of the three-way handshake stealth? Is it something like TCP mandates logging only when the connection is established? If so, then why?

Answer 1

There is no mandate, but the most common operating systems log only when the connection is fully established. As for the reason for that decision, you would have to ask the software authors (speculation is off topic here). You could, of course, write a custom socket library to log half-open connections if you are that interested.

Answer 2

TCP uses a "three-way handshake" which is actually four way. Each side sends a SYNchronize packet with its initial sequence number and the other side ACKnowledges the sequence number and asks for data.

1. initiator send SYN
2. listener sends ACK+SYN
3. initiator sends ACK

If the initiator skips the last part, the TCP connection is never fully connected. A RST may be send for cleanup.

Many system do not log that state, yet others do. Especially firewalls might.