OS Fingerprinting via SYN and ECN-Echo TCP Flags

312-50v12 By islever Editorial Last updated

Scanning Networks

Short answer

C The ethical hacker conducted Test 1 by sending a TCP packet with SYN and ECN-Echo flags to an open port to probe the nature of the response and determine the OS.

Question

A skilled ethical hacker was assigned to perform a thorough OS discovery on a potential target. They decided to adopt an advanced fingerprinting technique and sent a TCP packet to an open TCP port with specific flags enabled. Upon receiving the reply, they noticed the flags were SYN and ECN-Echo. Which test did the ethical hacker conduct and why was this specific approach adopted?
  1. Test 3: The test was executed to observe the response of the target system when a packet with URC, PSH, SYN, and FIN flags was sent, thereby identifying the OS
  2. Test 2: This test was chosen because a TCP packet with no flags enabled is known as a NULL packet and this would allow the hacker to assess the OS of the target
  3. Test 1: The test was conducted because SYN and ECN-Echo flags enabled to allow the hacker to probe the nature of the response and subsequently determine the OS fingerprint Correct Answer
  4. Test 6: The hacker selected this test because a TCP packet with the ACK flag enabled sent to a closed TCP port would yield more information about the OS

Key Takeaways

The core concept tested is TCP flag manipulation for OS detection; the trap involves confusing different flag combinations like NULL packets or Christmas tree packets with standard SYN probes.

This question examines TCP port scanning techniques used for OS fingerprinting, specifically identifying the test that utilizes SYN and ECN-Echo flags. It establishes that sending a packet with these specific flags to an open port is a method to probe system responses.

Common mistake: Candidates often confuse Test 1 (SYN) with Test 2 (NULL) or Test 3 (FIN/XMAS), failing to recognize that ECN-Echo is an option often associated with SYN in modern stacks for fingerprinting.

Expert Analysis

Why the Answer Is Correct

Test 1 involves sending a TCP packet with the SYN flag set to an open port. The inclusion of ECN-Echo (ECN-Nounce) is part of the TCP options field. Different operating systems handle these options differently, allowing the hacker to identify the OS based on the response. This matches the scenario described where SYN and ECN-Echo are observed.

Why the Other Options Are Wrong

Test 2 uses a NULL scan (no flags), which triggers different responses, typically RST for open ports and nothing for closed ones on non-Windows systems. Test 3 describes a FIN scan or XMAS scan depending on interpretation, but usually refers to sending FIN or URG/PSH/FIN flags, not SYN+ECN. Test 6 involves ACK scans or similar, which are less effective for OS fingerprinting compared to SYN-based analysis.

Community Comment Notes

Community consensus strongly supports C. As insaniunt noted, "Test 1: A TCP packet with the SYN and ECN-Echo flags enabled is sent to an open TCP port." Another user clarified the distinctions between tests, confirming that Test 1 corresponds to the SYN flag behavior described.

Exam Strategy

Focus on memorizing the specific flag combinations for each OS fingerprinting test type (NULL, SYN, FIN, XMAS). Understand how different OS kernels respond to invalid or unusual flag combinations.

Frequently Asked Questions

Why is ECN-Echo included in Test 1?

ECN-Echo is a TCP option. Operating systems handle optional fields differently, providing a unique signature for fingerprinting.

What is the difference between Test 1 and Test 2?

Test 1 sends a SYN packet, while Test 2 sends a NULL packet (no flags). They elicit different responses from the target OS.

More 312-50v12 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. insaniunt 👍 3 Answered C
    Test 1: A TCP packet with the SYN and ECN-Echo flags enabled is sent to an open TCP port.
  2. cloudgangster 👍 3
    The answer is C, These are the new questions in the pool.
  3. yicx1 👍 1
    Test 6: send to closed port. Test 2: send empty packet to open port. Test 3: send packet with set flags SYN|FIN|URG|PSH on open port without any options So the answer is Test 1: send packet with SYN flag with TCP options on open ports
  4. [Removed] 👍 1
    Could someone help me confirm if this is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide