ACK Flag Probe Scan for BSD TCP/IP Stack

Scanning Networks

Consider a scenario where a Certified Ethical Hacker is attempting to infiltrate a company's network without being detected. The hacker intends to use a stealth scan on a BSD-derived TCP/IP stack, but he suspects that the network security devices may be able to detect SYN packets. Based on this information, which of the following methods should he use to bypass the detection mechanisms and why?

Maimon Scan, because it is very similar to NULL, FIN, and Xmas scans, but the probe used here is FIN/ACK
Xmas Scan, because it can pass through filters undetected, depending on the security mechanisms installed
TCP Connect/Full-Open Scan, because it completes a three-way handshake with the target machine
ACK Flag Probe Scan, because it exploits the vulnerabilities within the BSD-derived TCP/IP stack Correct Answer

Answer Correct answer: D — Use the ACK Flag Probe Scan because it exploits the vulnerabilities within the BSD-derived TCP/IP stack to evade SYN detection.

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The key insight is that ACK scans are uniquely effective against BSD-derived systems due to their inconsistent response to ACK flags, unlike other OS implementations.

This question addresses the use of ACK Flag Probe Scans to bypass SYN packet detection on BSD-derived TCP/IP stacks. The correct method exploits specific implementation vulnerabilities in the BSD stack's handling of non-SYN packets.

Candidates often choose Maimon or Xmas scans because they also use unusual flag combinations, but these do not specifically exploit the BSD-derived TCP/IP stack vulnerability mentioned in the scenario.

Community Discussion (8 comments)

agelbahri 👍 2 Selected: D

CEH v12 pages: 311-313

NikeshMaharaj 👍 2

i think its option A: To bypass detection mechanisms on a BSD-derived TCP/IP stack, the Certified Ethical Hacker should use: A. Maimon Scan, because it is very similar to NULL, FIN, and Xmas scans, but the probe used here is FIN/ACK The Maimon Scan is effective because it sends a FIN/ACK probe, which can exploit certain vulnerabilities in the TCP/IP stack of BSD-derived systems. This type of scan is less likely to be detected by network security devices that are configured to detect SYN packets, making it a suitable choice for stealth scanning.

g_man_rap 👍 1

Option D, ACK Flag Probe Scan, is the most appropriate choice. This scan can provide insights into the network’s filtering behavior without the usual risks of detection associated with opening a full connection or sending irregular flag combinations, making it a more discreet option for initial reconnaissance, especially in environments that are sensitive to SYN packets.

qtygbapjpesdayazko 👍 3 Selected: D

The correct is D. Keyword "BSD-derived TCP/IP stack", BSD have a limitation in TCP/IP stack. ACK Flag Probe Scan Attackers send TCP probe packets with the ACK flag set to a remote device and then analyze the header information (TTL and WINDOW field) of the received RST packets to find out if the port is open or closed. The ACK flag probe scan exploits the vulnerabilities within the BSD-derived TCP/IP stack. Thus, such scanning is effective only on those OSs and platforms on which the BSD derives TCP/IP stacks. Module 03 Page 312

przemyslaw1 👍 2 Selected: D

Attackers send TCP probe packets with the ACK flag set to a remote device and then analyze the header information (TTL and WINDOW field) of the received RST packets to find out if the port is open or closed. The ACK flag probe scan exploits the vulnerabilities within the BSD-derived TCP/IP stack. Thus, such scanning is effective only on those OSs and platforms on which the BSD derives TCP/IP stacks.

Nopez 👍 1 Selected: D

D. via research

insaniunt 👍 1 Selected: B

B. Xmas Scan, because it can pass through filters undetected, depending on the security mechanisms installed. A Xmas Scan is a type of TCP port scan where the attacker sends TCP packets with the FIN, URG, and PSH flags set to target a specific range of ports. This scan is designed to evade detection mechanisms that may be configured to detect SYN packets or other standard scanning techniques.

qwerty100 👍 1 Selected: D

I am not very sure, but I think it's D (Module 03 Page 311and 312) ACK Flag Probe Scan Attackers send TCP probe packets with the ACK flag set to a remote device and then analyze the header information (TTL and WINDOW field) of the received RST packets to find out if the port is open or closed. The ACK flag probe scan exploits the vulnerabilities within the BSD-derived TCP/IP stack. Thus, such scanning is effective only on those OSs and platforms on which the BSD derives TCP/IP stacks.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The ACK Flag Probe Scan (Option D) is the correct choice because it specifically targets the known inconsistency in how BSD-derived TCP/IP stacks handle ACK packets. When an ACK packet is sent to a closed port, a BSD system sends a RST-ACK, whereas a SYN scan might be blocked by firewalls. This allows the hacker to determine if a port is open or filtered without completing a handshake.

Why the Other Options Are Wrong

Maimon Scan (A) uses FIN/ACK and is similar to NULL/FIN scans but doesn't have the same specific exploitation of the BSD ACK flaw. Xmas Scan (B) sets FIN, PSH, and URG flags, which is distinct from the ACK probe mechanism. TCP Connect (C) completes a full handshake, which is loud and easily detected, contradicting the goal of stealth.

Community Comment Notes

Community consensus strongly favors Option D, with many users citing CEH v12 textbook pages 311-313. As one user noted, "ACK Flag Probe Scan Attackers send TCP probe packets with the ACK flag set... to find out if the port is open or closed." Another user confirmed, "The ACK flag probe scan exploits the vulnerabilities within the BSD-derived TCP/IP stack."

Exam Strategy

When you see 'BSD-derived' in a CEH question regarding scanning techniques, immediately consider the ACK Flag Probe Scan. It is the classic example used to test knowledge of OS-specific TCP/IP stack implementation flaws.

Frequently Asked Questions

Why is ACK scan better than SYN scan here?

SYN scans are often blocked by firewalls. ACK scans can reveal firewall rules and exploit BSD stack inconsistencies to map ports stealthily.

Does ACK scan work on all OSs?

No. It is primarily effective on BSD-derived systems. Linux and Windows typically respond differently, making the scan less reliable there.

More 312-50v12 FAQ →

Related Analysis

← Back to 312-50v12 Study Guide