 Once a suitable zombie is found the next step would be to try to establish a TCP connection with a given service (port) of the target system, impersonating the zombie.It is done by sending a SYN packet to the target computer, spoofing the IP address from the zombie, i.e.with the source address equal to zombie IP address.