Port Scanning Techniques

Try it out loud first. Then check yourself:

1. TCP SYN scan (nmap -sS) sends SYN, reads SYN/ACK (open) or RST (closed), never completes the handshake
2. Connect scan (-sT) completes the handshake and is logged by apps; UDP scan (-sU) is slow and ambiguous
3. TCP: no response or ICMP unreachable usually means filtered; UDP: ICMP port unreachable means closed, silence is open|filtered
4. Service/version detection (-sV) and OS fingerprinting use banner and TCP/IP stack quirks
5. Detect via many ports from one source in a short window; masscan and slow scans evade naive thresholds

If the interviewer pushes back

• How does an idle (zombie) scan hide the true source of a scan?

Go deeper

• attack.mitre.org/techniques/T1046/