312-50V11 · Question #738
During an Xmas scan, what indicates a port is closed?
The correct answer is A. RST. In an Xmas scan, a RST/ACK packet returned by the target indicates the scanned port is closed, per RFC 793 TCP behavior.
Question
During an Xmas scan, what indicates a port is closed?
Options
- ARST
- BSYN
- CACK
- DNo return response
How the community answered
(33 responses)- A88% (29)
- B6% (2)
- C3% (1)
- D3% (1)
Why each option
In an Xmas scan, a RST/ACK packet returned by the target indicates the scanned port is closed, per RFC 793 TCP behavior.
RFC 793 specifies that when a TCP segment with unexpected flags (the FIN, PSH, and URG flags set in an Xmas scan) arrives at a closed port, the host must respond with a RST packet to reject the connection attempt. This RST response is the definitive signal that the port is closed and actively rejecting connections. An open port, by contrast, simply drops the unexpected packet and returns no response.
A SYN packet is used to initiate a TCP three-way handshake and is not a response generated by a host in reaction to an Xmas scan probe on any port.
A standalone ACK is not the expected response for a closed port during an Xmas scan; closed ports respond with RST per RFC 793, not with an ACK.
No response (silence) indicates an open or filtered port in an Xmas scan - open ports drop the unexpected flags per RFC 793 and send nothing back, making silence the indicator of open/filtered, not closed.
Concept tested: Xmas scan response behavior for closed ports
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.