What is the proper response for a NULL scan if the port is open?

A SYN packet is sent by a client to initiate a new connection and is never generated as a server response to an incoming NULL probe.

An ACK is used to acknowledge received data within an established session, not as a response to a flagless probe on an open port.

A FIN is used to gracefully terminate an existing connection and would not be sent in response to a NULL scan on an open port.

PSH is a data-pushing flag used within an active data transfer session and has no relevance as a response to a NULL probe.

An RST/ACK response is sent only when the port is closed, which is the opposite state being asked about here.

RFC 793 specifies that when a TCP segment arrives with no flags set at an open port, the receiving host must not send any response. This silence is how a scanner infers the port is open - the absence of a reply is the signal, making 'no response' the correct and expected behavior for an open port during a NULL scan.