With which of the following flag sets does the Xmas tree scan send a TCP frame to a remote device? Each correct answer represents a part of the solution. Choose all that apply.

The correct answer is A. PUSH C. FIN D. URG. An Xmas tree scan earns its name by "lighting up" three TCP flags simultaneously - FIN, PUSH, and URG - just like ornaments on a Christmas tree. These three flags are set in a single crafted TCP frame sent to the target, and the response (or lack thereof) reveals port state…

Network Security Threats, Attacks, and Vulnerabilities

Question

With which of the following flag sets does the Xmas tree scan send a TCP frame to a remote device? Each correct answer represents a part of the solution. Choose all that apply.

Options

APUSH
BRST
CFIN
DURG

How the community answered

(17 responses)

A
88% (15)
B
12% (2)

Explanation

An Xmas tree scan earns its name by "lighting up" three TCP flags simultaneously - FIN, PUSH, and URG - just like ornaments on a Christmas tree. These three flags are set in a single crafted TCP frame sent to the target, and the response (or lack thereof) reveals port state: closed ports return a RST, while open ports typically drop the packet silently on RFC-compliant systems.

RST (B) is wrong because RST is what the target sends back to indicate a closed port - it is not a flag the scanner sets in the outbound Xmas frame.

Memory tip: Think "FUP" - FIN, URG, PUSH - the three flags that go up on the Christmas tree. If you remember "FUP = Xmas scan," you'll never confuse it with other stealth scans like the FIN-only scan or the NULL scan (no flags set).

Topics

#TCP Flags#Port Scanning#Network Reconnaissance#Xmas Tree Scan

Community Discussion

No community discussion yet for this question.

Full 312-38 Practice