TCP FIN scanning is a type of stealth scanning through which the attacker sends a FIN packet to the target port. If the port is closed, the victim assumes that this packet was sent mistakenly by the attacker and sends the RST packet to the attacker. If the port is open, the FIN packet will be ignored and the port will drop the packet. Which of the following operating systems can be easily identified with the help of TCP FIN scanning?

Question

Accepted Answer

C. Windows Microsoft Windows does not fully comply with RFC 793, which requires open ports to silently discard unsolicited FIN packets. Instead, Windows sends RST packets regardless of port state. This non-standard behavior distinguishes Windows hosts from Unix-based systems during FIN scanning and makes fingerprinting straightforward.

Answer

A. Solaris Solaris follows RFC 793 compliant TCP stack behavior, correctly ignoring FIN packets on open ports and replying with RST only on closed ports.

Answer

B. Red Hat Red Hat Linux adheres to RFC 793, making it respond as the standard dictates and not easily distinguished via TCP FIN scanning alone.

Answer

D. Knoppix Knoppix is Linux-based and follows RFC 793 compliant behavior, ignoring FIN packets on open ports just like other standard Unix systems.

TCP FIN scanning is a type of stealth scanning through which the attacker sends a FIN packet to the target port. If the port is closed, the victim assumes that this packet was sent mistakenly by the a

Question

Options

How the community answered

Why each option

Topics

Community Discussion