John works as an Ethical Hacker for company Inc. He wants to find out the ports that are open in company's server using a port scanner. However, he does not want to establish a full TCP connection. Which of the following scanning techniques will he use to accomplish this task?

A TCP SYN scan, also known as a "half-open" scan, is the appropriate technique. The scanner sends a TCP packet with the SYN (synchronize) flag set to the target port. If the port is open, the target system responds with a SYN/ACK (synchronize/acknowledge) packet. Upon receiving the SYN/ACK, the scanner knows the port is open and sends a RST (reset) packet to tear down the connection before the three-way handshake is completed. This prevents the connection from being fully established and logged by many systems, fulfilling the requirement.

A. TCP FIN: This is a stealthy scan that sends a FIN packet. It relies on RFC 793 behavior where a closed port replies with RST, but an open port drops the packet, which is less reliable.
B. Xmas tree: This scan sends a packet with FIN, PSH, and URG flags set. Similar to a FIN scan, it is used to bypass some firewalls but is not the standard method described.
C. TCP SYN/ACK: This is a type of packet sent by a server in response to an initial SYN packet; it is not a scanning technique initiated by the client/hacker.

1. Lyon

G. F. (2009). Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Auditing. Nmap Project. In Chapter 5

"Port Scanning Techniques and Algorithms

" the section "SYN Scan (-sS)" details this method: "SYN scan is the default and most popular scan option... It is often referred to as half-open scanning

because you don't open a full TCP connection."

2. Boneh

D.

& Mitchell

J. (n.d.). CS 155: Computer and Network Security

Lecture 5: Network Security. Stanford University. On slide 15

"Stealth (SYN) Scan

" the process is outlined: "Scanner sends SYN(seq=x). If port is open

server responds with SYN/ACK(seq=y

ack=x+1). If port is closed

server responds with RST. Scanner sends RST to tear down connection." Retrieved from https://crypto.stanford.edu/cs155/lectures/05-network-security.pdf

3. Bhuyan

M. H.

Bhattacharyya

D. K.

& Kalita

J. K. (2013). Network Anomaly Detection: Methods

Systems and Tools. IEEE Communications Surveys & Tutorials

16(1)

303-336. Section III-A

"Port Scanning

" describes the TCP SYN scan as a primary stealth technique where a full connection is not established. https://doi.org/10.1109/SURV.2013.052213.00046