Free Preparation Discussions
MENU
Eccouncil 312-50 Exam - Topic 15 Question 122 Discussion
Topic #: 15
While performing an Nmap scan against a host, Paola determines the existence of a firewall. In an attempt to determine whether the firewall is stateful or stateless, which of the following options would be best to use?
-sA (TCP ACK scan)
This scan is different than the others discussed so far in that it never determines open (or even open|filtered) ports. It is used to map out firewall rulesets, determining whether they are stateful or not and which ports are filtered.
The ACK scan probe packet has only the ACK flag set (unless you use --scanflags). When scanning unfiltered systems, open and closed ports will both return a RST packet. Nmap then labels them as unfiltered, meaning that they are reachable by the ACK packet, but whether they are open or closed is undetermined. Ports that don't respond, or send certain ICMP error messages back (type 3, code 0, 1, 2, 3, 9, 10, or 13), are labeled filtered.
https://nmap.org/book/man-port-scanning-techniques.html
Pearlie
2 days agoKarl
7 days agoKeva
12 days agoKate
18 days agoJaney
23 days agoJosefa
28 days agoRanee
1 month agoValentin
1 month agoFausto
1 month agoShala
2 months agoGail
2 months agoLindsey
2 months agoYoulanda
2 months ago