312-50V11 · Question #491
While doing a technical assessment to determine network vulnerabilities, you used the TCP XMAS scan. What would be the response of all open ports?
The correct answer is C. The port will ignore the packets. A TCP XMAS scan sends packets with FIN, PSH, and URG flags set. Open ports silently discard these packets per RFC 793, while closed ports respond with RST.
Question
While doing a technical assessment to determine network vulnerabilities, you used the TCP XMAS scan. What would be the response of all open ports?
Options
- AThe port will send an ACK
- BThe port will send a SYN
- CThe port will ignore the packets
- DThe port will send an RST
How the community answered
(61 responses)- A2% (1)
- B7% (4)
- C89% (54)
- D3% (2)
Why each option
A TCP XMAS scan sends packets with FIN, PSH, and URG flags set. Open ports silently discard these packets per RFC 793, while closed ports respond with RST.
An ACK response is not generated by open ports in response to XMAS scan packets; ACKs are part of normal TCP handshake or established session traffic.
A SYN response is not a valid TCP behavior for any port receiving a XMAS-flagged packet; SYN is only used to initiate new connections.
According to RFC 793, when a TCP port is open, it will not respond to packets that do not have the SYN flag set and are not part of an established connection. A XMAS scan packet (FIN+PSH+URG) is ignored by open ports, making the lack of response the indicator that a port is open. This behavior is what makes XMAS scans useful for stealthy reconnaissance.
An RST response is sent by closed ports, not open ones, when they receive a XMAS scan packet.
Concept tested: TCP XMAS scan behavior on open ports
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.