3

As what I know, an open TCP scan is just a normal TCP 3-way handshake followed by RST. It is detectable because the target will log this connection.

For the half-open TCP scan, it is defined as "stealth". The explanation is that only a SYN packet is sent, which is also a 3-way handshake.

But these two seems same. I do not find what are the true difference?

Improve this question

2 Answers 2

Reset to default
6

This is the initiation of the 3-way handshake. but the scanner has no intend to complete it. This means it receives the SYN+ACK from the target (now knowing it's there), but never sends the final ACK itself (maintaining stealth).

Improve this answer
1
  • Hence, it means the 1st and 2nd steps of 3-way handshake are totally same? Then instead of final ACK, the 3rd step will be RST, or there is no 3rd step?
    – TJCLK
    Commented Jun 15, 2016 at 1:36
2

There will be 3rd step but in stealth scan third step is only RST where as on the other hand third step in Full open scan is ACK+RST.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.