What type of specific exploit is occurring here? The sequence of events is as follows: a TCP connection is established, sniffing commences, the TCP reset is executed, and then the evil hacker sends a connection to the server stating that he is a student.