Nmap

Question 1

TCP SYN (-sS)

Answer 1

fast technique, also called half-open scanning, as the scanning host requests a connection without acknowledging it. The target’s response to the scan’s SYN packet identifies the port state.

Question 2

TCP connect (-sT)

Answer 2

A half-open scan requires Nmap to have privileged access to the network driver to craft packets. If privileged access is unavailable, Nmap must use the OS to attempt a full TCP connection. This type of scan is less stealthy.

Question 3

TCP flags

Answer 3

You can scan by setting TCP headers in unusual ways. A Null (-sN) scan sets the header bit to zero, a FIN (-sF) scan sends an unexpected FIN packet, and an Xmas scan (-sX) sets the FIN, PSH, and URG flags. This was a means of defeating early types of firewalls and IDS.

Question 4

UDP scans (-sU)

Answer 4

Scan UDP ports. As these do not use ACKs, Nmap needs to wait for a response or timeout to determine the port state, so that UDP scanning can take a long time. A UDP scan can be combined with a TCP scan.