GCIH · Question #154
When you conduct the XMAS scanning using Nmap, you find that most of the ports scanned do not give a response. What can be the state of these ports?
The correct answer is A. Filtered. In an Nmap XMAS scan, ports that return no response are classified as open or filtered because a firewall may be silently dropping the probe packets. Filtered is the answer here because firewalls blocking packets is the most common reason no RST is returned when most ports are…
Question
When you conduct the XMAS scanning using Nmap, you find that most of the ports scanned do not give a response. What can be the state of these ports?
Options
- AFiltered
- BOpen
- CClosed
How the community answered
(42 responses)- A71% (30)
- B7% (3)
- C21% (9)
Why each option
In an Nmap XMAS scan, ports that return no response are classified as open or filtered because a firewall may be silently dropping the probe packets. Filtered is the answer here because firewalls blocking packets is the most common reason no RST is returned when most ports are unresponsive.
In a XMAS scan (FIN+PSH+URG flags set), RFC 793 specifies that open ports send no response, and filtered ports also send no response when a firewall silently drops packets. When the majority of scanned ports produce no response, a stateful firewall dropping packets (filtered) is the most likely explanation, as a server with most ports truly open would be unusually exposed.
Open ports do technically produce no response in a XMAS scan per RFC 793, but if most ports showed no response, attributing all to 'open' is not accurate - Nmap itself marks such ports 'open|filtered' precisely because it cannot distinguish them without additional context.
Closed ports respond to XMAS scan probes with a TCP RST/ACK packet, which is the opposite of no response.
Concept tested: Nmap XMAS scan port state interpretation
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.