Which scan sends an empty TCP ACK packet to the target directly?

Which scan sends an empty TCP ACK packet to the target directly?

• A. IP protocol ping
• B. ICMP ECHO ping scans
• C. TCP CONNECT / FULL OPEN Scan
• D. TCP ACK ping

Answer: (D)

TCP ACK ping probes how a host and network devices handle unsolicited TCP ACK segments. By sending an empty TCP acknowledgment with no payload directly to the target, you’re testing whether the network or the host will respond to a packet that isn’t part of an established connection. The behavior you observe—such as a lack of response or a reset—helps reveal firewall filtering and whether the path is stateful or stateless. This approach specifically targets TCP state handling and filtering rules, rather than simply checking reachability or attempting to complete a TCP connection. In contrast, an IP protocol ping uses a crafted IP packet that relies on a different protocol number at the IP layer, not a TCP ACK. An ICMP ECHO ping sends ICMP Echo Request messages to check whether the host is reachable at the IP layer. A TCP CONNECT / FULL OPEN scan actually completes a full three-way TCP handshake to a port to see if the service is listening. None of those involve sending an empty TCP ACK segment, which is why the TCP ACK ping is the correct method here.

TCP ACK ping probes how a host and network devices handle unsolicited TCP ACK segments. By sending an empty TCP acknowledgment with no payload directly to the target, you’re testing whether the network or the host will respond to a packet that isn’t part of an established connection. The behavior you observe—such as a lack of response or a reset—helps reveal firewall filtering and whether the path is stateful or stateless. This approach specifically targets TCP state handling and filtering rules, rather than simply checking reachability or attempting to complete a TCP connection.

In contrast, an IP protocol ping uses a crafted IP packet that relies on a different protocol number at the IP layer, not a TCP ACK. An ICMP ECHO ping sends ICMP Echo Request messages to check whether the host is reachable at the IP layer. A TCP CONNECT / FULL OPEN scan actually completes a full three-way TCP handshake to a port to see if the service is listening. None of those involve sending an empty TCP ACK segment, which is why the TCP ACK ping is the correct method here.