312-50V11 · Question #845
During an Xmas scan what indicates a port is closed?
The correct answer is B. RST. In an Xmas scan, a RST/RST-ACK response from the target indicates the scanned port is closed, while no response indicates the port is open or filtered.
Question
During an Xmas scan what indicates a port is closed?
Options
- ANo return response
- BRST
- CACK
- DSYN
How the community answered
(57 responses)- A2% (1)
- B93% (53)
- C2% (1)
- D4% (2)
Why each option
In an Xmas scan, a RST/RST-ACK response from the target indicates the scanned port is closed, while no response indicates the port is open or filtered.
No response in an Xmas scan indicates the port is open or filtered by a firewall, not closed.
RFC 793 TCP behavior specifies that a closed port receiving an unexpected packet (with FIN, PSH, and URG flags set, as in an Xmas scan) must respond with a RST segment. This RST response is the definitive indicator that the port is closed and actively rejecting the connection.
An ACK response is associated with ACK scans used to map firewall rules, not with Xmas scan port-closed detection.
A SYN packet initiates the TCP three-way handshake and is sent by the scanner, not returned as a port-closed indicator.
Concept tested: Xmas scan TCP response behavior for closed ports
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.