A penetration tester is performing a black-box assessment and needs to identify live hosts within a target network segment. They want to avoid sending any packets that would generate logs on the target's operating system or application layers, aiming for a very low-noise approach. Which Nmap host discovery technique, while less reliable on some systems, primarily aims to elicit responses only from the network stack without engaging higher-level services?
- ANULL Scan (-sN)
- BARP Ping (-PR)
- CTCP SYN Ping (-PS)
- DICMP Echo Ping (-PE)
Show answer & explanationAnswer & explanation
Correct answer: A. NULL Scan (-sN)
The NULL Scan (-sN) sends TCP packets with no flags set. According to RFC 793, if a port is closed, a RST packet should be returned. If a port is open, no response should be sent. This technique aims to interact only with the network stack, avoiding application-layer engagement and logging. While its reliability varies across OS types (especially Windows), it's designed for stealth by not completing handshakes or using common ICMP pings.
Why the other options are wrong
- B. ARP Ping (-PR) is for local subnet discovery and is low-noise, but the question implies a broader 'target network segment' and focuses on avoiding OS/application logs, which NULL scan directly addresses at the TCP layer.
- C. TCP SYN Ping (-PS) still sends a SYN packet, which, although not completing the handshake, is a standard part of TCP connection initiation and can be detected.
- D. ICMP Echo Ping (-PE) is a very common and easily detectable host discovery method, often logged and filtered.
Nmap NULL Scan (-sN)
A stealthy Nmap scan that sends TCP packets with no flags (SYN, ACK, RST, FIN, PSH, URG) set. It relies on RFC 793 behavior where closed ports respond with RST and open ports send no response, aiming to avoid application-layer logging.
- Sends TCP packets with no flags.
- Relies on RFC 793 behavior (open = no response, closed = RST).
- Highly stealthy, aims to bypass firewalls and NIDS.
- Effectiveness is OS-dependent (Windows often ignores).
Memory trick: NULL is 'No Usual Logging Lure'.