312-50V11 · Question #97
What is a NULL scan?
The correct answer is A. A scan in which all flags are turned off. A NULL scan is a TCP port scanning technique where every TCP flag in the packet header is set to zero, used to probe ports while evading some firewalls and intrusion detection systems.
Question
What is a NULL scan?
Options
- AA scan in which all flags are turned off
- BA scan in which certain flags are off
- CA scan in which all flags are on
- DA scan in which the packet size is set to zero
- EA scan with a illegal packet size
How the community answered
(36 responses)- A89% (32)
- B6% (2)
- D3% (1)
- E3% (1)
Why each option
A NULL scan is a TCP port scanning technique where every TCP flag in the packet header is set to zero, used to probe ports while evading some firewalls and intrusion detection systems.
In a NULL scan, the TCP packet is sent with no flags set - SYN, ACK, FIN, RST, PSH, and URG are all turned off (zero). This technique exploits RFC 793 behavior where compliant systems respond differently to flagless packets depending on whether the port is open or closed, allowing an attacker to enumerate port states without completing a full TCP handshake.
A scan with only certain flags off describes other scan types such as FIN or Xmas scans, which selectively set or clear specific flags rather than clearing all flags simultaneously.
A scan with all flags turned on is called an Xmas scan (or Christmas tree scan), not a NULL scan - it is essentially the inverse of a NULL scan.
Packet size is irrelevant to the NULL scan definition; the distinguishing characteristic is the TCP flag field being zeroed out, not the payload length or total packet size.
Illegal packet size refers to malformed packet attacks unrelated to the TCP flag manipulation that defines NULL scanning technique.
Concept tested: NULL scan TCP flag configuration
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.