Which scan attempt can penetrate through a router and a firewall that filter incoming packets with particular flags set and is not supported by Windows?

A TCP Null scan sends a TCP packet with no flags set. According to RFC 793, a host with an open port should drop such a packet, while a host with a closed port should respond with a TCP RST (Reset) packet. Many stateless firewalls and routers are configured to filter incoming packets with the SYN flag (to block new connections) but may allow packets with no flags to pass. This allows the Null scan to penetrate the perimeter defense. However, Microsoft Windows operating systems do not comply with RFC 793 in this regard and will not send a response regardless of port state, making this scan ineffective against them.

A. An ARP scan operates at Layer 2 and cannot pass through a router, which operates at Layer 3. It is limited to the local subnet.
B. A TCP full connect scan completes the three-way handshake (SYN, SYN/ACK, ACK) and is easily detected and blocked by firewalls filtering SYN packets.
D. A PING (ICMP) sweep is not a TCP scan and does not use TCP flags. It is commonly blocked by firewalls that filter ICMP echo request packets.

1. Postel, J. (1981). RFC 793: Transmission Control Protocol. Internet Engineering Task Force (IETF). Section 3.4 specifies the expected behavior for segment processing, which Null scans exploit. The behavior for closed ports is described on page 65.

2. Lyon, G. F. (n.d.). Nmap Network Scanning: Port Scanning Techniques. Nmap.org. The section "Null, FIN, and Xmas Scans (-sN, -sF, -sX)" explicitly states, "The big downside is that not all systems follow RFC 793 to the letter. A number of systems, particularly Microsoft Windows...respond the same way regardless of whether the port is open or closed."

3. Teo, L. (2018). A study of stealth port scanning methods. Purdue University, CERIAS Tech Report 2018-1. This academic report analyzes various scanning techniques, detailing how Null scans (Section 3.3) are designed to bypass firewalls and their limitations against non-RFC-compliant stacks like Windows.