Certified Ethical Hacker (CEH) Practice Question

The TCP SYN (half-open) scan, invoked with the -sS option, sends only the initial SYN packet to each target port. If the port is open, the server replies with SYN/ACK, and Nmap immediately responds with an RST instead of completing the handshake. Because the TCP three-way handshake is never finished, many intrusion detection or logging systems that focus on completed connections do not record the attempt, making the technique comparatively stealthy. A TCP connect scan (-sT) does complete the handshake and is therefore more likely to be logged. A UDP scan (-sU) probes UDP ports, not TCP, and a FIN scan (-sF) relies on sending bare FIN packets, which can be filtered or ignored and is primarily useful against stateless filtering devices, not stateful firewalls that monitor connection states.