Which scan uses FIN/ACK probes such that no response indicates Open|Filtered and an RST response indicates a closed port?

Which scan uses FIN/ACK probes such that no response indicates Open|Filtered and an RST response indicates a closed port?

• A. Xmas Scan
• B. Stealth Scan
• C. TCP Maimon Scan
• D. ACK Flag Probe Scan

Answer: (A)

Understanding how TCP flag-based probes reveal port state is being tested here. In this approach, we send a packet with unusual flag combinations and observe the target’s reply to infer whether a port is open, closed, or filtered. The pattern described matches the Christmas scan. This scan uses a packet with multiple flags set (FIN along with PSH and URG). The typical responses from targets are: when a port is closed, many TCP stacks reply with a RST; when a port is open, the stack generally does not respond to such a nonstandard packet; if a filter or firewall blocks the packet, you also get no response. Therefore, no response points to Open or Filtered, and a RST points to Closed. This makes the Christmas scan the best fit for the described behavior. Other scan types rely on different flag configurations and yield different response patterns, so they wouldn’t consistently produce the same open|filtered vs. closed interpretation described.

Understanding how TCP flag-based probes reveal port state is being tested here. In this approach, we send a packet with unusual flag combinations and observe the target’s reply to infer whether a port is open, closed, or filtered.

The pattern described matches the Christmas scan. This scan uses a packet with multiple flags set (FIN along with PSH and URG). The typical responses from targets are: when a port is closed, many TCP stacks reply with a RST; when a port is open, the stack generally does not respond to such a nonstandard packet; if a filter or firewall blocks the packet, you also get no response. Therefore, no response points to Open or Filtered, and a RST points to Closed. This makes the Christmas scan the best fit for the described behavior.

Other scan types rely on different flag configurations and yield different response patterns, so they wouldn’t consistently produce the same open|filtered vs. closed interpretation described.