[OldWolf]

This boiled down to how internet protocols connect at the most basic level.
EXAMPLE: website connection!
When you enter a address in your browser after necessary DNS requests to find the ip, your computer sends out a SYN packet to port 80(webserver port) to the web site.
The server will then send back an ACK packet to say YES the port is open.
A series of back and fore packets occure before browser connection and page veiwing....but that do not matter in this explanation.
This only uses the first 2 packets


This scan sends out a single SYN packet to a pre-set list of network ports. each SYN packet has a FROM and TO address in it.
all this does is randomize the FROM IP in all the syn packets sent.
The trick is being as the ACK is sent along the connection the original SYN is sent through the acknowledgement is seen even from a spoofed address and the connection is left hanging with no response from the spoofed address.