312-50V9 · Question #530
What is the proper response for a NULL scan if the port is closed?
The correct answer is E. RST. In a TCP NULL scan, a closed port responds with an RST packet, while an open port returns no response, per RFC 793 behavior.
Question
What is the proper response for a NULL scan if the port is closed?
Options
- ASYN
- BACK
- CFIN
- DPSH
- ERST
- FNo response
How the community answered
(47 responses)- B4% (2)
- D6% (3)
- E87% (41)
- F2% (1)
Why each option
In a TCP NULL scan, a closed port responds with an RST packet, while an open port returns no response, per RFC 793 behavior.
SYN is used to initiate the TCP three-way handshake and is not a response type sent in reply to NULL scan probes.
ACK acknowledges received data in an established TCP connection and is not sent in response to unsolicited NULL scan packets on closed ports.
FIN signals the graceful termination of an existing TCP connection and is not used as a reply to NULL scan probes.
PSH (Push) is a data-delivery flag used within established TCP sessions to deliver buffered data immediately, not a response to NULL scans.
RFC 793 specifies that when a TCP segment arrives at a closed port with no matching connection state, the host must send back an RST (Reset) packet to reject the connection attempt. This RST response is the defining characteristic of a closed port in NULL, FIN, and Xmas scan techniques. The absence of any flags in the NULL scan probe makes the RST response the only RFC-compliant reply for a closed port.
No response indicates an open or filtered port in a NULL scan, not a closed port - this is the opposite behavior.
Concept tested: TCP NULL scan closed port RST response behavior
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.