Which host discovery technique probes multiple ports to determine if they are online and to detect firewall behavior?

Which host discovery technique probes multiple ports to determine if they are online and to detect firewall behavior?

• A. IP protocol ping
• B. TCP ACK ping
• C. TCP SYN ping
• D. ICMP ECHO ping scans

Answer: (C)

Probing multiple ports with a TCP SYN ping is designed to discover a host and infer firewall behavior by how it responds to a range of TCP ports. In a SYN scan, you send a SYN to each port in the target set and watch the replies. If you receive a SYN-ACK, the port is open, and you typically send a RST to avoid completing the handshake. If you receive a RST, the port is closed. If there is no reply, the port is filtered by a firewall. By scanning many ports, you can determine that the host is online (any port responding) even if other probes are blocked, and you can deduce firewall rules based on which ports are filtered or allowed. This combination—checking several ports and interpreting open/closed/filtered responses—is why this method best fits host discovery with firewall behavior detection. Other methods either rely on ICMP echo requests, which only test reachability and not port state, or use different TCP flag combinations (like sending TCP ACKs) that don’t provide the same multi-port online status and firewall behavior clues.

Probing multiple ports with a TCP SYN ping is designed to discover a host and infer firewall behavior by how it responds to a range of TCP ports. In a SYN scan, you send a SYN to each port in the target set and watch the replies. If you receive a SYN-ACK, the port is open, and you typically send a RST to avoid completing the handshake. If you receive a RST, the port is closed. If there is no reply, the port is filtered by a firewall. By scanning many ports, you can determine that the host is online (any port responding) even if other probes are blocked, and you can deduce firewall rules based on which ports are filtered or allowed. This combination—checking several ports and interpreting open/closed/filtered responses—is why this method best fits host discovery with firewall behavior detection.

Other methods either rely on ICMP echo requests, which only test reachability and not port state, or use different TCP flag combinations (like sending TCP ACKs) that don’t provide the same multi-port online status and firewall behavior clues.