Techno Security Inc. recently hired John as a penetration tester. He was tasked with identifying open ports in the target network and determining whether the ports are online and any firewall rule set

The -PP flag triggers an ICMP timestamp request ping scan, not a TCP SYN scan, and relies on ICMP timestamp reply messages rather than TCP handshake responses.

The -PO flag performs an IP Protocol ping scan, sending packets across multiple IP protocols to detect live hosts, which is unrelated to TCP SYN-based discovery.

The -PS flag instructs Nmap to perform a TCP SYN ping scan by sending a SYN packet to port 80 by default and analyzing whether a SYN/ACK or RST is returned to determine host availability. Combined with -sn, which disables port enumeration, the scan focuses purely on host discovery. This technique is effective at identifying live hosts and can reveal stateful firewall rules based on which ports elicit responses.

The -PA flag sends TCP ACK packets rather than SYN packets, which is used specifically to bypass stateless firewalls that block SYN packets, not to perform a SYN ping scan.