312-50V10 · Question #738
During an Xmas scan, what indicates a port is closed?
The correct answer is A. RST. In an Xmas scan, a closed port replies with a RST packet, which is the standard TCP behavior for receiving an unsolicited segment with no active connection.
Question
During an Xmas scan, what indicates a port is closed?
Options
- ARST
- BSYN
- CACK
- DNo return response
How the community answered
(30 responses)- A90% (27)
- C3% (1)
- D7% (2)
Why each option
In an Xmas scan, a closed port replies with a RST packet, which is the standard TCP behavior for receiving an unsolicited segment with no active connection.
Per RFC 793, when a host receives a TCP segment with FIN, PSH, and URG flags set (Xmas pattern) on a closed port, it responds with a RST/ACK packet to signal that no connection exists. This RST response is the definitive indicator used by Nmap to classify a port as closed during an Xmas scan.
A SYN packet initiates a TCP three-way handshake and is sent by a client opening a new connection; it is not a response generated by a target host during an Xmas scan.
An ACK is used to acknowledge received data in an established TCP session; a host does not send a standalone ACK in response to an unsolicited Xmas-flagged segment on a closed port.
No response (silence) indicates an open or filtered port in an Xmas scan - open ports drop the unexpected packet per RFC 793, while filtered ports may be blocked by a firewall, both resulting in no reply.
Concept tested: TCP Xmas scan closed port RST response behavior
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.