Up to now we have seen the most important scanning types to discover network.
There are some other scanning techniques in Nmap which are not used as much as the others. But in some
cases you may need to find some other ways to be able to discover the sensitive hosts in a network.
In this slide we'll see 3 more scan types.
NULL, FIN and XMAS scans. The common ground of these three scanning methods.
NULL
FIN and XMAS scans.
is that they send packets to the target systems in which SYN, ACK and RST flags are not set.
Null scan (-­sN) does not set any bits, i.e. TCP flag header is 0. FIN scan (sF) sets
just the TCP FIN bit. Xmas scan (sX) sets the FIN, PSH, and URG flags, lighting the
packet up like a Christmas tree.
There are two rules defined in RFC standards about such packets:
The first rule is, if the destination port state is CLOSED, an incoming segment not containing a RST
causes a RST to be sent in response.
The second rule is, packets sent to OPEN ports without the SYN, RST, or ACK bits set are dropped. These three scan
types are exactly the same in behaviour except for the TCP flags set in probe packets..
If a RST packet is received, the port is considered closed. While no response means it is open or filtered.
If an ICMP unreachable error (type 3, code 0, 1, 2, 3, 9, 10, or 13) is received,
The port is marked as filtered. So as a result with these types of scans, you can find out if a port
is closed or not.
It's not possible to understand if it's open or filtered if there's no response.
This scan is different than the others discussed so far in that it never determines open (or even open|filtered)
ports.
It's used to map out firewall rulesets determining whether they're stateful or not and which ports are
The ACK scan probe packet has only the ACK flag set. When scanning unfiltered systems open and
closed port will both return a RST packet Nmap then labels them as unfiltered meaning that they
are reachable by the ACK packet. But whether they are open or closed is undetermined. Ports that don't
respond or send certain ICMP error messages back.
(type 3, code 0, 1, 2, 3, 9, 10, or 13), are labeled filtered.