Certified Ethical Hacker (CEH) Practice Question

FIN, NULL, and Xmas scans rely on RFC-compliant behavior: a closed port responds with RST, whereas an open port ignores the probe. If the edge firewall silently drops every inbound TCP segment that lacks the SYN flag-without forwarding it or sending any response-the attacker receives no packet back in either case. All probed ports therefore appear as 'filtered', preventing the scanner from distinguishing open from closed ports. Sending RSTs for every probe (or forwarding them to the host) still reveals that a service is present or absent, and ICMP error messages can be equally useful to the attacker. Redirecting the traffic to a tarpit may slow the probe but still lets the attacker know which ports accept connections. Dropping the packets at the perimeter provides the most effective and least disruptive countermeasure.