GCIH · Question #160
connection. Which of the following scanning techniques will he use to accomplish this task?
The correct answer is C. TCP SYN. TCP SYN scanning sends a SYN packet to initiate a half-open connection probe without completing the three-way handshake, enabling stealthy port discovery.
Question
connection. Which of the following scanning techniques will he use to accomplish this task?
Options
- ATCP FIN
- BTCP SYN/ACK
- CTCP SYN
- DXmas tree
How the community answered
(31 responses)- B3% (1)
- C94% (29)
- D3% (1)
Why each option
TCP SYN scanning sends a SYN packet to initiate a half-open connection probe without completing the three-way handshake, enabling stealthy port discovery.
TCP FIN scanning sends a FIN packet to closed ports expecting a RST response and is used for firewall evasion and OS fingerprinting, not for standard half-open connection probing.
TCP SYN/ACK is a response packet sent by a listening service during the handshake - it is not a technique used to initiate a scan.
TCP SYN scanning works by sending a SYN packet to the target port - an open port responds with SYN/ACK, and the scanner immediately sends a RST to abort the connection before it is fully established. This half-open technique avoids creating a full TCP session, reducing log entries on many systems and making it the most common and effective port scanning method.
Xmas tree scanning sets the FIN, URG, and PSH flags simultaneously to elicit RFC-defined RST responses from closed ports and is a stealth technique distinct from half-open SYN scanning.
Concept tested: TCP SYN half-open port scanning technique
Source: https://nmap.org/book/synscan.html
Topics
Community Discussion
No community discussion yet for this question.