TCP FIN scanning is a type of stealth scanning through which the attacker sends a FIN packet to the target port. If the port is closed, the victim assumes that this packet was sent mistakenly by the…

Solaris adheres to RFC 793 behavior by dropping FIN packets on open ports and replying with RST only on closed ports, so it does not produce the identifying RST anomaly that FIN scanning is designed to detect.

Red Hat Linux complies with RFC 793, silently dropping FIN packets on open ports, and therefore behaves the same as other standard-compliant systems rather than revealing its identity through a spurious RST.

Knoppix is a Linux-based OS that also follows RFC 793, dropping FIN packets on open ports without sending RST, making it indistinguishable from other compliant systems in a FIN scan.

Windows does not implement the RFC 793 standard correctly - it sends an RST packet in response to a FIN probe regardless of whether the targeted port is open or closed. This non-standard behavior exposes Windows hosts during FIN scanning, because a compliant OS would silently drop the FIN on open ports and only respond with RST on closed ones, making the anomalous RST a fingerprint of Windows.