What is the proper response for a NULL scan if the port is open?

A SYN response is sent only by a target initiating or responding to a three-way handshake, not as a reply to a NULL scan probe.

An ACK response is part of established TCP session communication and is not generated in response to a NULL scan on an open port.

A FIN packet is used to gracefully terminate an active TCP connection and is not returned as a response to a NULL scan.

PSH is a data-push flag used within active TCP sessions to prompt immediate delivery and is not returned in response to a NULL scan probe.

A RST response is the reply sent when a NULL scan probe hits a closed port, not an open one.

According to RFC 793, when an open port receives a packet with no TCP flags set, the TCP stack silently discards the packet and sends no reply. This absence of response is how an attacker infers the port is open when using a NULL scan. In contrast, a closed port will reply with a RST/ACK packet, making the two states clearly distinguishable.