nerdexam
GIAC

GCIH · Question #50

In which of the following scanning methods do Windows operating systems send only RST packets irrespective of whether the port is open or closed?

The correct answer is A. TCP FIN. Windows deviates from RFC 793 in TCP FIN scanning by responding with RST packets regardless of port state.

Reconnaissance, Scanning, and Enumeration

Question

In which of the following scanning methods do Windows operating systems send only RST packets irrespective of whether the port is open or closed?

Options

  • ATCP FIN
  • BFTP bounce
  • CXMAS
  • DTCP SYN

How the community answered

(48 responses)
  • A
    94% (45)
  • B
    2% (1)
  • D
    4% (2)

Why each option

Windows deviates from RFC 793 in TCP FIN scanning by responding with RST packets regardless of port state.

ATCP FINCorrect

In TCP FIN scanning, RFC 793-compliant systems (Unix/Linux) silently drop FIN packets sent to open ports, allowing port state inference. However, Windows does not follow this behavior and responds with RST packets for both open and closed ports, making FIN scans unable to distinguish port states on Windows hosts. This OS-specific deviation is a well-documented limitation of FIN scanning against Windows targets.

BFTP bounce

FTP bounce scanning exploits the FTP PORT command to proxy scan requests through an FTP server and is unrelated to RST packet behavior.

CXMAS

XMAS scanning sets FIN, URG, and PSH flags simultaneously; while Windows also sends RST in this case, the question specifically describes FIN scan behavior.

DTCP SYN

TCP SYN scanning expects SYN-ACK for open ports and RST for closed ports across all operating systems, and is not the scenario described.

Concept tested: TCP FIN scan behavior differences on Windows

Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html

Topics

#TCP FIN scan#Windows RST behavior#port scanning#scan techniques

Community Discussion

No community discussion yet for this question.

Full GCIH Practice