What type of scan is Hayden attempting here?

Hayden is the network security administrator for her company, a large finance firm based in Miami. Hayden just returned from a security conference in Las Vegas where they talked about all kinds of old and new security threats; many of which she did not know of. Hayden is worried about the current security state of her company’s network so she decides to start scanning the network from an external IP address. To see how some of the hosts on her network react, she sends out SYN packets to an IP range. A number of IPs responds with a SYN/ACK response. Before the connection is established she sends RST packets to those hosts to stop the session. She does this to see how her intrusion detection system will log the traffic. What type of scan is Hayden attempting here?

Hayden is the network security administrator for her company, a large finance firm based in Miami. Hayden just returned from a security conference in Las Vegas where they talked about all kinds of old and new security threats; many of which she did not know of. Hayden is worried about the current security state of her company’s network so she decides to start scanning the network from an external IP address. To see how some of the hosts on her network react, she sends out SYN packets to an IP range. A number of IPs responds with a SYN/ACK response. Before the connection is established she sends RST packets to those hosts to stop the session. She does this to see how her intrusion detection system will log the traffic. What type of scan is Hayden attempting here?

A.
Hayden is attempting to find live hosts on her company’s network by using an XMAS scan

B.
She is utilizing a SYN scan to find live hosts that are listening on her network

C.
The type of scan, she is using is called a NULL scan

D.
Hayden is using a half-open scan to find live hosts on her network

Show Hint

Leave a Reply 7

Your email address will not be published. Required fields are marked *

rednael

rednael

a SYN scan is the same as a Half-Open scan…
http://en.wikipedia.org/wiki/Port_scanner#SYN_scanning

Actually, when a TCP port is “half-open”, only an ACK and a SYN/ACK are sent, no RST. The RST closes the half-open port.

And because answer B also states that the hosts “are listening on your network”, that answer is more correct then answer D

Reply

ichop

ichop

Also, CEH V7.1 slide 20 for Module #3 calls this scan Stealth or Half-open, NOT SYN.

Reply

Unethica

Unethica

Also, another question has “SYN scan” as the correct answer for the same scenario…?

Reply

Adel

Adel

Yes, there is another q with same content but the B answer..!!

Reply

Me

Me

Everywhere I look, all the experts agree that “SYN Scanning” = “Half Open Scanning”…
Therefore, this questions sucks unless BOTH are selected as correct.

Reply

Adel

Adel

I would go for B.
You may have a live host but do not listen on the port scanned, or a live host that do not respond to connections from outside the network, both these hosts wont reply to the scan. So, The scan is to find live and responding hosts..

Reply