GPEN · Question #323
In which of the following scanning methods do Windows operating systems send only RST packets irrespective of whether the port is open or closed?
The correct answer is A. TCP FIN. In a TCP FIN scan, Windows systems do not comply with RFC 793 and respond with RST packets regardless of whether the scanned port is open or closed, making the scan unreliable against Windows targets.
Question
In which of the following scanning methods do Windows operating systems send only RST packets irrespective of whether the port is open or closed?
Options
- ATCP FIN
- BTCP SYN
- CFTP bounce
- DXMAS
How the community answered
(20 responses)- A70% (14)
- B5% (1)
- C15% (3)
- D10% (2)
Why each option
In a TCP FIN scan, Windows systems do not comply with RFC 793 and respond with RST packets regardless of whether the scanned port is open or closed, making the scan unreliable against Windows targets.
RFC 793 specifies that a closed port should respond to a FIN packet with RST, while an open port should silently drop it - this distinction is what TCP FIN scanning exploits on Unix/Linux systems. However, Windows deviates from this standard by sending RST packets for both open and closed ports, meaning the tester cannot differentiate port states and the scan yields no useful results against Windows hosts.
TCP SYN scanning sends SYN packets and distinguishes open ports by SYN/ACK responses versus RST for closed ports - it does not involve FIN-based probing and behaves differently across OS types.
FTP bounce scanning abuses the FTP PORT command to have an FTP server proxy scan requests to a third-party target, and is unrelated to FIN packet behavior or OS-level TCP stack quirks.
An XMAS scan sets the FIN, PSH, and URG flags simultaneously; while it shares the same RFC 793 evasion intent as FIN scanning, it is a distinct technique and not the one described here.
Concept tested: TCP FIN scan behavior on Windows OS
Source: https://nmap.org/book/scan-methods-null-fin-xmas-scan.html
Topics
Community Discussion
No community discussion yet for this question.