ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ148

VerifiedNetwork Penetration Testing Methodology – Internal

Karen performed port scans on every machine in her network to identify suspicious ports on the target systems. During a scan of one particular machine, she observed:

  1. Some ports were not acknowledged; that is, the target machine sent no acknowledgment.
  2. Some ports responded with SYN + ACK packets.
  3. Some ports responded with an RST packet.

How should she interpret the ports that did not return an acknowledgment?

Explanation

For a TCP SYN scan, a SYN+ACK response indicates an open port, while an RST response indicates a closed port. No response generally indicates that a firewall or filtering device is silently dropping the probe; this is characterized as a stealth port in the available terminology.

Community Discussion

No comments yet. Be the first to start the discussion!