Sam is a penetration tester hired by Inception Tech, a security organization. He was asked to perform port scanning on a target host in the network. While performing the given task, Sam sends…

Xmas scan sets the FIN, PSH, and URG flags simultaneously on probe packets, not FIN/ACK, and interprets no response as an open port rather than relying on RST packets to identify closed ports.

IDLE/IPID scan is a covert technique that uses a third-party zombie host's incrementing IP ID field to infer port status on the target without sending packets directly from the attacker's own IP address.

TCP Maimon scan, named after researcher Uriel Maimon, sends FIN/ACK packets to probe target ports on a host. According to RFC 793 behavior, a closed port on a compliant system responds with an RST packet, while an open port typically drops the packet and returns nothing, allowing the attacker to infer port state. This technique is effective at evading stateless packet filters and certain firewalls that do not track connection state.

ACK flag probe scan sends packets with only the ACK flag set and is primarily used to map firewall rulesets and determine whether ports are statefully filtered, not to identify open versus closed ports.