Ports Open/Close

With BOLD is the attacker/client send flags

TCP Connect

open: SYN, SYN/ACK, ACK, RST

close: SYN, RST

Stealth Scan(Half Open)

open: SYN, SYN/ACK, RST

close: SYN, RST

Inverse TCP flag

open: FIN/URG/PSH/NULL, No Response

close: FIN/URG/PSH/NULL, RST/ACK

Xmas Scan

open: FIN+URG+PSH, No Response

close: FIN+URG+PSH, RST/ACK

Null Scan

open: No Response

close: RST

ACK flag Probe Scanning

Attacker/client sends only ACK package. If he receives on RST flag that means the port is there and open. Also on "NO RESPONSE" means that a stateful firewall is present. On a RST flag means no firewall is in place.

IDLE Scan(sends packets from IDLE zombie)

UDP Scanning(No flags sent, No 3-way Handshake made)

open: No Response

close: ICMP port unreadable UDP port scanning is often unreliable, as firewalls and routers may drop ICMP packets. This can lead to false positives in your scan, and you will regularly see UDP port scans showing all UDP ports open on a scanned machine. People often forget to scan for UDP services, and stick only to TCP scanning, thereby seeing only half of the equation.

FIN Scanning

open: No Response

close: RST

ACK Scanning

open: RST

close: No Response