What are the scan types -sN, -sF, and -sX, and when might you use each?

What are the scan types -sN, -sF, and -sX, and when might you use each?

• A. -sN Null scan (no flags) tests firewall behavior; -sF FIN scan; -sX Xmas (FIN+PSH+URG) used to detect filtering; use to probe firewall rules.
• B. -sN uses UDP probes; -sF uses TCP probes; -sX uses ICMP.
• C. -sN is OS detection; -sF is version detection; -sX is script scanning.
• D. -sN is root-only; -sF and -sX are for non-root.

Answer: (A)

These scans are TCP flag-based stealth probes that test how a target or its firewall responds to unusual packets. They’re built around sending crafted TCP segments with different flag combinations to observe typical firewall or host behavior. Null scan sends a packet with no flags set. Because it looks like no legitimate TCP connection attempt, many firewalls or intrusion defenses will drop it or ignore it, helping you infer filtering behavior. If the port is closed on the target, some stacks may still respond with a reset; if it’s open or filtered, you often get no reply, which points to filtering or opening decisions at the network edge. FIN scan sends a FIN flag without attempting to establish a connection. The expected pattern is that closed ports usually reply with a reset to indicate closure, while open ports tend to ignore the FIN because there’s no connection to finish. Firewalls or filters may either drop or alter the response, so this type helps reveal how those devices treat abnormal close-semantics traffic. Xmas scan sets FIN, PSH, and URG flags simultaneously, creating an unusually illuminated packet. Many systems treat this as suspicious or malformed, and again you’ll see differences in responses based on whether a port is closed, open, or filtered. This makes it useful for probing firewall rules and IDS behavior that might react to abnormal traffic patterns. When to use these: they’re handy in early reconnaissance when you want to understand how firewalls and IDS respond to nonstandard TCP packets, which can help map filtering rules or detect defensive behaviors. Keep in mind that many modern networks and security systems detect or rate-limit these scans, and root privileges are typically required to craft and send raw packets.

These scans are TCP flag-based stealth probes that test how a target or its firewall responds to unusual packets. They’re built around sending crafted TCP segments with different flag combinations to observe typical firewall or host behavior.

Null scan sends a packet with no flags set. Because it looks like no legitimate TCP connection attempt, many firewalls or intrusion defenses will drop it or ignore it, helping you infer filtering behavior. If the port is closed on the target, some stacks may still respond with a reset; if it’s open or filtered, you often get no reply, which points to filtering or opening decisions at the network edge.

FIN scan sends a FIN flag without attempting to establish a connection. The expected pattern is that closed ports usually reply with a reset to indicate closure, while open ports tend to ignore the FIN because there’s no connection to finish. Firewalls or filters may either drop or alter the response, so this type helps reveal how those devices treat abnormal close-semantics traffic.

Xmas scan sets FIN, PSH, and URG flags simultaneously, creating an unusually illuminated packet. Many systems treat this as suspicious or malformed, and again you’ll see differences in responses based on whether a port is closed, open, or filtered. This makes it useful for probing firewall rules and IDS behavior that might react to abnormal traffic patterns.

When to use these: they’re handy in early reconnaissance when you want to understand how firewalls and IDS respond to nonstandard TCP packets, which can help map filtering rules or detect defensive behaviors. Keep in mind that many modern networks and security systems detect or rate-limit these scans, and root privileges are typically required to craft and send raw packets.