Hack$Notes
Search…
Ports Open/Close
With BOLD is the attacker/client send flags

TCP Connect

open: SYN, SYN/ACK, ACK, RST
close: SYN, RST

Stealth Scan(Half Open)

open: SYN, SYN/ACK, RST
close: SYN, RST

Inverse TCP flag

open: FIN/URG/PSH/NULL, No Response
close: FIN/URG/PSH/NULL, RST/ACK

Xmas Scan

open: FIN+URG+PSH, No Response
close: FIN+URG+PSH, RST/ACK

Null Scan

open: No Response
close: RST

ACK flag Probe Scanning

Attacker/client sends only ACK package. If he receives on RST flag that means the port is there and open. Also on "NO RESPONSE" means that a stateful firewall is present. On a RST flag means no firewall is in place.

IDLE Scan(sends packets from IDLE zombie)

UDP Scanning(No flags sent, No 3-way Handshake made)

open: No Response
close: ICMP port unreadable UDP port scanning is often unreliable, as firewalls and routers may drop ICMP packets. This can lead to false positives in your scan, and you will regularly see UDP port scans showing all UDP ports open on a scanned machine. People often forget to scan for UDP services, and stick only to TCP scanning, thereby seeing only half of the equation.

FIN Scanning

open: No Response
close: RST

ACK Scanning

open: RST
close: No Response
Last modified 2yr ago