Michael works for Kimball Construction Company as senior security analyst. As part of yearly security audit, Michael scans his network for vulnerabilities. Using
Nmap, Michael conducts XMAS scan and most of the ports scanned do not give a response. In what state are these ports?
When conducting an XMAS scan with Nmap, if most of the ports do not give a response, it means that those ports are in a 'filtered' state. This indicates that the ports are protected by a firewall or other security mechanisms, preventing Nmap from determining whether the ports are open or closed.
D is the answer , why would open port not respond with an Ack
open|filtered
When scanning systems compliant with this RFC text, any packet not containing SYN, RST, or ACK bits will result in a returned RST if the port is closed and no response at all if the port is open. NMAP guide https://nmap.org/book/scan-methods-null-fin-xmas-scan.html So it is open
The ports that do not give a response to an XMAS scan are considered in the "Filtered" state. This means that the ports are being protected by a firewall or some other security mechanism that is preventing Nmap from determining whether the port is open or closed.
Correct answer is B: ports are open In a XMAS scan, if the ports are open no response are received. If the port are closed, an RST is received. https://upadhyayraj.medium.com/nmap-xmas-scan-idle-scan-fin-scan-null-scan-b95a5c73bef6
A xmas scan without response is a Filtered port (drop packet) IMHO
It should be filtered port D.
B is right. If the port is closed it respond with RST, if it's open, no response.
from nmap.org: No response received (even after retransmissions) open|filtered
B. Example Xmas scans admin# nmap -sX -T4 scanme.nmap.org Starting Nmap ( https://nmap.org ) Nmap scan report for scanme.nmap.org (64.13.134.52) Not shown: 999 open|filtered ports PORT STATE SERVICE 113/tcp closed auth
B > The UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way. open|filtered
A Christmas Scan is very chatty. This will return the ports that are open and other information. B is Correct