312-50V10 · Question #97
What is a NULL scan?
The correct answer is A. A scan in which all flags are turned off. A NULL scan is a TCP port scanning technique where a probe packet is sent with all TCP flags cleared to zero, used to infer port state on target systems.
Question
What is a NULL scan?
Options
- AA scan in which all flags are turned off
- BA scan in which certain flags are off
- CA scan in which all flags are on
- DA scan in which the packet size is set to zero
- EA scan with a illegal packet size
How the community answered
(32 responses)- A91% (29)
- B3% (1)
- D6% (2)
Why each option
A NULL scan is a TCP port scanning technique where a probe packet is sent with all TCP flags cleared to zero, used to infer port state on target systems.
In a NULL scan, the TCP packet is crafted with every flag bit - SYN, ACK, FIN, RST, PSH, and URG - set to zero. This non-standard packet causes RFC-compliant TCP stacks to respond predictably based on whether the target port is open or closed. The technique can bypass certain stateless firewall rules that only filter packets carrying specific flag combinations.
A scan with only certain flags off describes other scan types such as FIN or XMAS scans, not a NULL scan where every flag is cleared.
A scan with all flags turned on describes an XMAS scan, which is the direct opposite of a NULL scan.
Packet size is unrelated to TCP flag configuration; a NULL scan is defined entirely by its flag state, not by packet size.
An illegal packet size is a separate concept unrelated to a NULL scan, which specifically refers to the absence of any TCP flag bits.
Concept tested: TCP NULL scan definition and flag configuration
Source: https://nmap.org/book/man-port-scanning-techniques.html
Topics
Community Discussion
No community discussion yet for this question.