Certified Ethical Hacker (CEH) Practice Question

The open|filtered state appears when Nmap fails to receive a TCP response that lets it distinguish between an open and a filtered port. A firewall, load balancer, or router operating as a SYN proxy (sometimes called TCP intercept) answers the attacker's initial SYN on behalf of the protected host but withholds the internal SYN/ACK until the handshake is fully completed. Because Nmap never receives the expected SYN/ACK or RST packets during its half-open scan, it classifies every probed port as open|filtered even though legitimate clients can still complete full connections.

Port knocking hides individual daemons but would also require legitimate users to perform the knock sequence. Simply disabling TCP timestamps or using a NAT device without a SYN proxy does not prevent Nmap from seeing normal SYN/ACK or RST responses, so ports would still be shown as open or closed rather than open|filtered. An application-layer gateway that enforces TLS mutual authentication operates after the TCP handshake and therefore would not affect Nmap's scan results.