EC-Council Certified Ethical Hacker (CEH) v12Reconnaissance TechniquesHard
A penetration tester is evaluating the robustness of a client's perimeter network. They need to identify all open TCP ports on a range of external IP addresses. The client has a strict policy against any scanning techniques that could cause service disruption or be easily detectable by common firewalls and IDS/IPS. Which Nmap scan type is generally considered the most stealthy and least disruptive for identifying open TCP ports, while still being effective?
- ATCP Connect Scan (-sT)
- BUDP Scan (-sU)
- CFIN Scan (-sF)
- DTCP SYN Scan (-sS)
Show answer & explanationAnswer & explanation
Correct answer: D. TCP SYN Scan (-sS)
The TCP SYN Scan (-sS), also known as a 'half-open' scan, sends a SYN packet and waits for a SYN/ACK. If received, it sends an RST packet instead of completing the three-way handshake. This makes it stealthier than a full TCP Connect Scan because the connection is never fully established, reducing the likelihood of logging by the target system and often bypassing simpler firewalls/IDS.
Why the other options are wrong
- A. TCP Connect Scan (-sT) completes the full three-way handshake, which is easily logged and less stealthy.
- B. UDP Scan (-sU) is for UDP ports, not TCP, and is often slower and less reliable for identifying open ports due to statelessness.
- C. FIN Scan (-sF) can be stealthy, but its effectiveness depends on the OS (Windows often ignores FIN packets for closed ports), making it less universally reliable than SYN scan for identifying open ports.
TCP SYN Scan (-sS)
A stealthy Nmap scan technique that sends a SYN packet and, upon receiving a SYN/ACK, immediately sends an RST packet, never completing the TCP three-way handshake. This 'half-open' nature makes it less detectable by application-layer logs.
- Also known as 'half-open' scan.
- Does not complete TCP handshake.
- Less likely to be logged by target applications.
- Effective for identifying open TCP ports stealthily.
Memory trick: SYN is subtle; Connect is complete; FIN is finicky.