Which scan sends ACK probe packets and analyzes the WINDOW field value of the RST packets?

Which scan sends ACK probe packets and analyzes the WINDOW field value of the RST packets?

• A. TTL-Based ACK Flag Probing Scanning
• B. ACK Flag Probe Scan
• C. Window-Based ACK Flag Scanning
• D. IDLE/IPID Header Scan

Answer: (A)

This question tests how a TCP fingerprinting scan uses an ACK probe and a particular TCP header field to identify the target’s stack. When you send a probe with the ACK flag set, the target may respond with an RST packet. The crucial detail examined is the TCP window size value in that RST response. Different operating systems and TCP/IP stacks tend to use different default window sizes, so by observing the window value the scanner can fingerprint the target more accurately. This exact method is known as Window-Based ACK Flag Scanning. TTL-based ACK flag probing would focus on the TTL values in responses rather than the window field, so it’s not about the window size. An ACK flag probe scan that doesn’t emphasize the window field wouldn’t provide the same OS-differentiating signals. IDLE/IPID header scanning relies on IPID sequencing patterns, not TCP window sizes.

This question tests how a TCP fingerprinting scan uses an ACK probe and a particular TCP header field to identify the target’s stack. When you send a probe with the ACK flag set, the target may respond with an RST packet. The crucial detail examined is the TCP window size value in that RST response. Different operating systems and TCP/IP stacks tend to use different default window sizes, so by observing the window value the scanner can fingerprint the target more accurately. This exact method is known as Window-Based ACK Flag Scanning.

TTL-based ACK flag probing would focus on the TTL values in responses rather than the window field, so it’s not about the window size. An ACK flag probe scan that doesn’t emphasize the window field wouldn’t provide the same OS-differentiating signals. IDLE/IPID header scanning relies on IPID sequencing patterns, not TCP window sizes.