During an Xmas scan what indicates a port is closed?

No response to an Xmas scan probe indicates the port is open or filtered - an open port on an RFC-compliant TCP stack silently drops the unexpected flagged packet rather than replying.

An Xmas scan sends a TCP packet with the FIN, PSH, and URG flags simultaneously set. Per RFC 793, a closed port must reply with a RST/ACK packet, signaling that no service is listening on that port. This RST response is the definitive closed-port indicator shared by all out-of-state flag scans including NULL, FIN, and Xmas.

An ACK response is relevant to ACK scans used to identify firewall filtering rules and distinguish filtered from unfiltered ports, not the standard closed-port reply in an Xmas scan.

A SYN packet is the outgoing probe used in SYN scans to initiate a half-open handshake and is not a response type that would indicate a closed port during an Xmas scan.