In an SCTP COOKIE ECHO scan, the absence of a response from a port typically indicates which state?

In an SCTP COOKIE ECHO scan, the absence of a response from a port typically indicates which state?

• A. The port is closed
• B. The port is open
• C. The host is unreachable
• D. The port is filtered

Answer: (B)

In this type of SCTP probe, you’re testing how the protocol’s COOKIE-ECHO handshake behaves at a listening port. When a port is open and an SCTP listener is present, the COOKIE-ECHO exchange can proceed, but the response pattern you see to the probe is not a straightforward, immediate confirmation back to the scanner. The expected outcome is the absence of a direct reply within the probe’s timeout. That lack of response is interpreted as the port being open, because there’s no explicit rejection, reset, or error message coming from a non-listening or filtered endpoint. If the port were closed, you’d typically see a concrete refusal or error response; if it were filtered, packets would be dropped and you’d also get no reply, but the scan method distinguishes “no response” as indicating open in this SCTP COOKIE-ECHO context. In practice, timing and device behavior can affect results, so it’s wise to corroborate with additional probes.

In this type of SCTP probe, you’re testing how the protocol’s COOKIE-ECHO handshake behaves at a listening port. When a port is open and an SCTP listener is present, the COOKIE-ECHO exchange can proceed, but the response pattern you see to the probe is not a straightforward, immediate confirmation back to the scanner. The expected outcome is the absence of a direct reply within the probe’s timeout. That lack of response is interpreted as the port being open, because there’s no explicit rejection, reset, or error message coming from a non-listening or filtered endpoint. If the port were closed, you’d typically see a concrete refusal or error response; if it were filtered, packets would be dropped and you’d also get no reply, but the scan method distinguishes “no response” as indicating open in this SCTP COOKIE-ECHO context. In practice, timing and device behavior can affect results, so it’s wise to corroborate with additional probes.