312-50V9 · Question #537
What is a NULL scan?
The correct answer is A. A scan in which all flags are turned off. A NULL scan sets all TCP header flags to zero, making it a stealthy reconnaissance technique used to probe ports without initiating a handshake.
Question
What is a NULL scan?
Options
- AA scan in which all flags are turned off
- BA scan in which certain flags are off
- CA scan in which all flags are on
- DA scan in which the packet size is set to zero
- EA scan with a illegal packet size
How the community answered
(46 responses)- A87% (40)
- C7% (3)
- D4% (2)
- E2% (1)
Why each option
A NULL scan sets all TCP header flags to zero, making it a stealthy reconnaissance technique used to probe ports without initiating a handshake.
In a NULL scan, every TCP flag (SYN, ACK, FIN, RST, PSH, URG) is set to 0 (off). This unusual flagless packet exploits how RFC 793-compliant systems respond differently depending on port state, allowing stealthy port enumeration without triggering standard connection logging.
Turning off only certain flags describes other specialized scan types such as FIN scans, not a NULL scan, which requires ALL flags to be off simultaneously.
Having all flags turned on describes an XMAS scan, which is the opposite of a NULL scan.
Setting the packet size to zero is unrelated to TCP flag manipulation and does not define a NULL scan.
An illegal packet size refers to a malformed or oversized packet, which is a distinct concept unrelated to NULL scan flag configuration.
Concept tested: TCP NULL scan flag configuration
Source: https://nmap.org/book/man-port-scanning-techniques.html
Topics
Community Discussion
No community discussion yet for this question.