TCP session hijacking is taking over an already established TCP conversation by interfering with its state, sequence numbers, or packets. Because TCP is stateful, both endpoints trust a shared flow of acknowledgments and ordering. If an attacker can insert, delay, forge, or redirect packets well enough to confuse that state, they may impersonate one side of the connection without opening a new session.
This matters because many services rely on long-lived TCP sessions for logins, management, file transfer, and application traffic. In real attacks, hijacking can involve packet injection, source spoofing, desynchronizing endpoints, or manipulating middleboxes that track connection state, such as NAT devices or proxies. Defenses include encrypted and authenticated application protocols, anti-spoofing controls, strong state validation, and monitoring for unexpected sequence changes or connection-state anomalies. When session state is protected, it becomes much harder to bend an active conversation into an attacker-controlled one.