GCIH · Question #50
In which of the following scanning methods do Windows operating systems send only RST packets irrespective of whether the port is open or closed?
The correct answer is A. TCP FIN. Windows deviates from RFC 793 in TCP FIN scanning by responding with RST packets regardless of port state.
Question
In which of the following scanning methods do Windows operating systems send only RST packets irrespective of whether the port is open or closed?
Options
- ATCP FIN
- BFTP bounce
- CXMAS
- DTCP SYN
How the community answered
(48 responses)- A94% (45)
- B2% (1)
- D4% (2)
Why each option
Windows deviates from RFC 793 in TCP FIN scanning by responding with RST packets regardless of port state.
In TCP FIN scanning, RFC 793-compliant systems (Unix/Linux) silently drop FIN packets sent to open ports, allowing port state inference. However, Windows does not follow this behavior and responds with RST packets for both open and closed ports, making FIN scans unable to distinguish port states on Windows hosts. This OS-specific deviation is a well-documented limitation of FIN scanning against Windows targets.
FTP bounce scanning exploits the FTP PORT command to proxy scan requests through an FTP server and is unrelated to RST packet behavior.
XMAS scanning sets FIN, URG, and PSH flags simultaneously; while Windows also sends RST in this case, the question specifically describes FIN scan behavior.
TCP SYN scanning expects SYN-ACK for open ports and RST for closed ports across all operating systems, and is not the scenario described.
Concept tested: TCP FIN scan behavior differences on Windows
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.