An attacker may however monitor the packets, and try to send a packet with the next sequence number in order. It's unlikely to succeed if the two endpoints are in active conversation, because odds are they will have moved on to a greater sequence number by the time his packet arrives, however, when the server is slow to respond (such as when it is under DDoS), the attacker might have enough time to slip his packet.