How does an Nmap connect scan work?

An Nmap connect scan (-sT) uses the operating system's high-level connect() system call to establish a full connection to a target port. This process precisely follows the standard TCP three-way handshake. The scanner initiates by sending a SYN packet. If the port is open, the target responds with a SYN/ACK packet. The scanner's OS completes the handshake by sending an ACK packet. A successful completion of this handshake indicates the port is open. Because a full connection is established, this scan type is easily detectable and logged by the target system.

A. This sequence describes a SYN scan (-sS) or "half-open" scan, where the connection is reset before being fully established to avoid logging.

B. The expected response from an open port to an initial SYN packet is a SYN/ACK, not a standalone ACK.

C. This is not a valid TCP connection establishment sequence; a client does not send a SYN/ACK after receiving an ACK.

1. Official Nmap Documentation: Lyon, G. (n.d.). Port Scanning Techniques. Nmap Network Scanning. Retrieved from https://nmap.org/book/man-port-scanning-techniques.html. In the "TCP connect scan (-sT)" section, it states, "Nmap asks the underlying operating system to establish a connection... This is the same high-level system call that web browsers, P2P clients, and most other network-enabled applications use to establish a connection. ... If the port is open, the connect() call will succeed". The success of the connect() call is predicated on the completion of the three-way handshake (SYN, SYN/ACK, ACK).

2. University Courseware: Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 3, Section 3.5.3, "TCP Connection Management," the text details the three-way handshake for connection setup: "Step 1: The client-side TCP first sends a special TCP segment to the server-side TCP. ... This special segment contains no application-layer data. It does, however, have one of the flag bits in the segment’s header, the so-called SYN bit, set to 1." "Step 2: ... the server TCP sends a special TCP segment of its own." "Step 3: ... the client again sends another special segment." This sequence corresponds to SYN, SYN/ACK, and ACK.

3. University Courseware: Balakrishnan, H. (2018). Lecture 13: Networking III: TCP. MIT OpenCourseWare, 6.033 Computer System Engineering, Spring 2018. Slide 13 explicitly diagrams the "TCP 3-way Handshake" as Client (sends SYN) -> Server (sends SYN+ACK) -> Client (sends ACK).