Which scan relies on analyzing the WINDOW field value of RST packets in response to ACK probes?

Which scan relies on analyzing the WINDOW field value of RST packets in response to ACK probes?

• A. ACK Flag Probe Scan
• B. IDLE/IPID Header Scan
• C. Window-Based ACK Flag Probe Scanning
• D. INIT Scan

Answer: (C)

The technique being tested hinges on TCP behavior: the window field in a RST response to an ACK probe can reveal how the target’s TCP stack would handle a future connection. In window-based ACK flag probe scanning, you send ACK packets to a port and observe the RST that the host sends back, paying close attention to the Window value in that RST. Different port states (open, closed, or filtered) cause the OS to populate the window field differently. By comparing these observed window sizes across probes, you can infer whether a port is open or closed even when simple probes are being filtered or misdirected by a firewall. This reliance on the Window field is what sets this method apart from other ACK-based or IPID-based techniques. Other options rely on different signals: ACK Flag Probe Scan focuses on how ACKs and firewall behavior appear; IDLE/IPID Header Scan uses the IPID sequence to fingerprint responses via a zombie host; INIT Scan targets initial sequence patterns. None of those hinge on the TCP Window field in RST responses to ACK probes, which is why the window-based approach is the correct choice.

The technique being tested hinges on TCP behavior: the window field in a RST response to an ACK probe can reveal how the target’s TCP stack would handle a future connection. In window-based ACK flag probe scanning, you send ACK packets to a port and observe the RST that the host sends back, paying close attention to the Window value in that RST. Different port states (open, closed, or filtered) cause the OS to populate the window field differently. By comparing these observed window sizes across probes, you can infer whether a port is open or closed even when simple probes are being filtered or misdirected by a firewall. This reliance on the Window field is what sets this method apart from other ACK-based or IPID-based techniques.

Other options rely on different signals: ACK Flag Probe Scan focuses on how ACKs and firewall behavior appear; IDLE/IPID Header Scan uses the IPID sequence to fingerprint responses via a zombie host; INIT Scan targets initial sequence patterns. None of those hinge on the TCP Window field in RST responses to ACK probes, which is why the window-based approach is the correct choice.