GPEN · Question #482
Analyze the excerpt from a packet capture between the hosts 192.168.116.9 and 192.168.116.101. What factual conclusion can the tester draw from this output?
The correct answer is C. Ports 139 and 135 are open. A packet capture showing TCP SYN packets receiving SYN-ACK replies on both ports 135 and 139 confirms that both ports are actively open and accepting connections on the target host.
Question
Analyze the excerpt from a packet capture between the hosts 192.168.116.9 and 192.168.116.101. What factual conclusion can the tester draw from this output?
Exhibit
Options
- APort 135 is filtered, port 139 is open.
- BPons 135 and 139 are filtered.
- CPorts 139 and 135 are open.
- DPort 139 is closed, port 135 is open
How the community answered
(36 responses)- A3% (1)
- B8% (3)
- C83% (30)
- D6% (2)
Why each option
A packet capture showing TCP SYN packets receiving SYN-ACK replies on both ports 135 and 139 confirms that both ports are actively open and accepting connections on the target host.
A filtered port produces no response (the SYN is silently dropped), while an open port returns SYN-ACK; the capture does not show the asymmetric pattern of one filtered and one open port.
Filtered ports are identified by the complete absence of any reply to a SYN probe; if both ports were filtered the capture would show no responses, contradicting the observable data.
In a TCP port scan visible in a packet capture, an open port is identified by a SYN-ACK response to the scanner's SYN packet, indicating the target is actively listening. If both ports 135 and 139 show SYN-ACK replies, both are open. A closed port returns RST-ACK, and a filtered port produces no reply at all.
A closed port returns a RST-ACK packet in response to a SYN probe; the capture does not show RST-ACK behavior for port 139, so it cannot be concluded that port 139 is closed.
Concept tested: TCP port state identification from packet capture analysis
Source: https://nmap.org/book/man-port-scanning-basics.html
Topics
Community Discussion
No community discussion yet for this question.
