Which scan type sends TCP probe packets with a TCP flag (FIN, URG, PSH) set or with no flags?

Which scan type sends TCP probe packets with a TCP flag (FIN, URG, PSH) set or with no flags?

• A. Inverse TCP Flag Scan
• B. Xmas Scan
• C. Stealth Scan
• D. INIT Scan

Answer: (A)

Understanding how TCP flag configurations affect responses is the key idea. Inverse TCP Flag Scan uses unusual flag patterns to probe ports: it sends TCP packets where a FIN/UR/PSH set is used (the flags associated with an “Xmas” style packet) or packets with no flags, rather than the typical SYN-based probes. The target’s reply (often a RST for closed ports or no reply for open ports, depending on the stack) helps determine whether a port is open or closed, while sometimes evading simpler detections that look for standard scans. This approach is what distinguishes the inverse flag scan from other flag-based techniques that stick to a single normal pattern (like always using FIN/UR/PSH, or always using no flags).

Understanding how TCP flag configurations affect responses is the key idea. Inverse TCP Flag Scan uses unusual flag patterns to probe ports: it sends TCP packets where a FIN/UR/PSH set is used (the flags associated with an “Xmas” style packet) or packets with no flags, rather than the typical SYN-based probes. The target’s reply (often a RST for closed ports or no reply for open ports, depending on the stack) helps determine whether a port is open or closed, while sometimes evading simpler detections that look for standard scans. This approach is what distinguishes the inverse flag scan from other flag-based techniques that stick to a single normal pattern (like always using FIN/UR/PSH, or always using no flags).