PT0-001 · Question #181
When running an Nmap SYN scan, what will be the Nmap result if ports on the target device do not respond?
The correct answer is C. Filtered. When an Nmap SYN scan receives no response to a SYN probe, the port is classified as filtered, indicating a firewall or packet filter is silently dropping the packets.
Question
When running an Nmap SYN scan, what will be the Nmap result if ports on the target device do not respond?
Options
- AOpen
- BClosed
- CFiltered
- DListening
How the community answered
(35 responses)- A3% (1)
- B6% (2)
- C89% (31)
- D3% (1)
Why each option
When an Nmap SYN scan receives no response to a SYN probe, the port is classified as filtered, indicating a firewall or packet filter is silently dropping the packets.
An open port actively responds to the SYN probe with a SYN-ACK packet, confirming a service is listening and accepting connections on that port.
A closed port responds with a RST packet, indicating the host is reachable and the port is accessible but no service is currently listening on it.
In a SYN scan, if no response arrives after a SYN packet is sent, Nmap cannot determine whether a service is present - the silence indicates a firewall or filtering device is blocking the probe before it reaches the port. Nmap labels this state 'filtered' to distinguish it from a closed port that actively returns a RST packet. This behavior is characteristic of stateful firewalls configured to drop rather than reject unsolicited connection attempts.
Listening is not a valid Nmap port state - Nmap uses the defined states open, closed, filtered, unfiltered, open-filtered, and closed-filtered to classify scanned ports.
Concept tested: Nmap SYN scan filtered port state identification
Source: https://nmap.org/book/man-port-scanning-basics.html
Topics
Community Discussion
No community discussion yet for this question.