Which Nmap scan sends packets with only the SYN flag set and does not complete the TCP handshake?

Question

Options

• ATCP Connect Scan
• BACK Scan
• CSYN Scan
• DFIN Scan

• A
  3% (2)
• B
  2% (1)
• C
  90% (52)
• D
  5% (3)

Explanation

SYN Scan (also called a "half-open scan") works by sending a packet with only the SYN flag set - if the port is open, the target responds with SYN-ACK, but Nmap immediately sends RST instead of completing the handshake with ACK, leaving the connection half-open. This is why C is correct: it initiates but never completes the TCP three-way handshake.

• A (TCP Connect Scan) is wrong because it does complete the full three-way handshake (SYN → SYN-ACK → ACK), making it more detectable and logged by the OS.
• B (ACK Scan) is wrong because it sends packets with only the ACK flag set - it's used for firewall rule mapping, not port discovery.
• D (FIN Scan) is wrong because it sends packets with only the FIN flag set, exploiting RFC behavior to infer open/closed ports - no SYN involved.

Memory tip: Think "SYN = half-open handshake" - SYN starts a connection but never seals it, just like the letter S starts the word "Stealth," which is exactly why this scan is preferred for stealthy reconnaissance.

No community discussion yet for this question.