312-50V13 · Question #82
What is the proper response for a NULL scan if the port is closed?
The correct answer is E. RST. In a TCP NULL scan, if a port is closed, the target system will respond with a RST (Reset) packet, indicating that the connection was refused.
Question
Options
- ASYN
- BACK
- CFIN
- DPSH
- ERST
- FNo response
How the community answered
(34 responses)- B6% (2)
- C3% (1)
- D3% (1)
- E88% (30)
Why each option
In a TCP NULL scan, if a port is closed, the target system will respond with a RST (Reset) packet, indicating that the connection was refused.
A SYN (Synchronize) flag is used to initiate a connection, not as a response to a NULL scan on a closed port.
An ACK (Acknowledgement) flag is used to acknowledge received data or connection setup, not as a response to a NULL scan on a closed port.
A FIN (Finish) flag is used to gracefully terminate a connection, not as a response to a NULL scan on a closed port.
A PSH (Push) flag is used to ensure data is sent immediately, not as a response to a NULL scan on a closed port.
According to RFC 793, if a closed port on a target system receives a TCP segment without any flags (a NULL scan), the system will respond with a RST (Reset) packet, indicating an active refusal of the connection because no application is listening.
No response is characteristic of a filtered port (e.g., by a firewall), not a closed port, in a NULL scan.
Concept tested: TCP NULL scan responses for closed ports
Source: https://www.rfc-editor.org/rfc/rfc793#section-3.4
Topics
Community Discussion
No community discussion yet for this question.