Scanning networks
⏱ ~3-min readAceMark Guide
What this topic is really about
An XMAS scan sets the FIN, PSH, and URG flags ("lighting up the packet like a Christmas tree") to elicit different responses from open vs closed ports per the RFC. SYN-only is a half-open scan, and SYN/ACK is part of the normal handshake.
-sS sends a SYN, evaluates the response, and resets before completing the handshake — faster and less likely to be logged than -sT (full connect). -sU is UDP, -sV does version detection.
See the mechanism
-sS sends a SYN, evaluates the response, and resets before completing the handshake — faster and less likely to be logged than -sT (full connect). A diagram for this topic isn't available yet — the worked example below walks the same reasoning step by step.
An exam-style question, fully explained
Which Nmap option performs a TCP SYN (half-open) scan?
- Identify what the question tests: Which Nmap option performs a TCP SYN (half-open) scan.
- -sS sends a SYN, evaluates the response, and resets before completing the handshake — faster and less likely to be logged than -sT (full connect).
- -sU is UDP, -sV does version detection.
Traps the examiner sets
- Read each option carefully — distractors on Scanning networks are designed to look plausible.
- Re-check the exact wording of the question stem before committing to an answer.
- Watch the qualifiers ("always", "only", "except") that flip a correct-looking option.
Test your recall
Answer each from memory — you'll see instantly whether you're right and why.
Run a focused 10-question mini-mock on Scanning networks and see it stick.
Practice more of this topic →