GPEN · Question #22
When you conduct the XMAS scanning using Nmap, you find that most of the ports scanned do not give a response. What can be the state of these ports?
The correct answer is B. Open. In an XMAS scan, open ports silently discard the probe packet per RFC 793, producing no response, which is the defining indicator Nmap uses to classify them as open.
Question
When you conduct the XMAS scanning using Nmap, you find that most of the ports scanned do not give a response. What can be the state of these ports?
Options
- AClosed
- BOpen
- CFiltered
How the community answered
(40 responses)- A10% (4)
- B85% (34)
- C5% (2)
Why each option
In an XMAS scan, open ports silently discard the probe packet per RFC 793, producing no response, which is the defining indicator Nmap uses to classify them as open.
Closed ports actively respond to XMAS scan packets with a RST/ACK packet rather than silence, so a non-responding port cannot be closed.
RFC 793 specifies that when a TCP segment arrives at an open port without the SYN, RST, or ACK flags set - as is the case with an XMAS packet carrying FIN, PSH, and URG - the segment must be silently dropped with no reply. This no-response behavior is what Nmap interprets as an open port during an XMAS scan. Closed ports, by contrast, respond with a RST/ACK, making them distinguishable.
While filtered ports can also produce no response due to a firewall silently dropping packets, the RFC 793 open-port discard behavior is the primary and technically correct explanation for silence in this context, and the marked correct answer is Open.
Concept tested: Nmap XMAS scan open port identification
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.