How does a SYN stealth scan (-sS) differ from a TCP connect scan (-sT) in terms of connection behavior and detectability?

How does a SYN stealth scan (-sS) differ from a TCP connect scan (-sT) in terms of connection behavior and detectability?

• A. -sS sends a SYN and analyzes responses without completing the handshake, making it stealthier; -sT completes the three-way handshake, making it easier to detect and log.
• B. -sS completes the three-way handshake, making it easier to detect; -sT uses stealth SYN probes.
• C. -sS uses UDP probes; -sT uses TCP probes.
• D. -sS detects OS; -sT detects services.

Answer: (A)

The key idea is how each scan handles the TCP connection and what that means for being seen by the target and logs. A SYN stealth scan sends just a SYN and waits for a response. If the port is open, the target replies with SYN-ACK, and the scanner immediately tears the connection down with a RST, so no full three-way handshake is completed. Because the connection isn’t established, there’s often no normal log entry of an established TCP session, making this approach harder for the target to log or correlate as a real connection. It’s considered stealthier for that reason. A TCP connect scan, on the other hand, uses the OS’s normal TCP stack to perform a full connect. It completes the three-way handshake (SYN, SYN-ACK, ACK) and only then closes. That establishes an actual connection on the target side, which is typically recorded in logs and monitoring tools, making it much more visible and easier to detect and log. Privilege and how the scan is implemented can also differ, since the connect scan relies on standard socket calls and often doesn’t require raw privileges, whereas the stealth SYN scan usually requires raw sockets and elevated privileges.

The key idea is how each scan handles the TCP connection and what that means for being seen by the target and logs. A SYN stealth scan sends just a SYN and waits for a response. If the port is open, the target replies with SYN-ACK, and the scanner immediately tears the connection down with a RST, so no full three-way handshake is completed. Because the connection isn’t established, there’s often no normal log entry of an established TCP session, making this approach harder for the target to log or correlate as a real connection. It’s considered stealthier for that reason.

A TCP connect scan, on the other hand, uses the OS’s normal TCP stack to perform a full connect. It completes the three-way handshake (SYN, SYN-ACK, ACK) and only then closes. That establishes an actual connection on the target side, which is typically recorded in logs and monitoring tools, making it much more visible and easier to detect and log. Privilege and how the scan is implemented can also differ, since the connect scan relies on standard socket calls and often doesn’t require raw privileges, whereas the stealth SYN scan usually requires raw sockets and elevated privileges.