GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ473

Scanning and Mapping

An analyst runs the following Nmap scan from a Linux computer as a non-privileged user. The target host, 10.0.233.2, has tcp/445 open. What network traffic is generated by this scan?

$ nmap 10.0.233.2
  • A ICMP echo and reply between the source and destination
  • B No traffic will be captured as the scan is passive
  • C TCP handshake between the source and destination hosts
  • D ACK packets from the source to the destination
Explanation

For an unprivileged user on Linux, Nmap uses a TCP connect scan when it cannot send raw packets. A connect scan establishes a full TCP connection to an open port, producing the SYN, SYN/ACK, and ACK packets of the TCP three-way handshake. Nmap then terminates the connection. Nmap: TCP Connect Scan

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!