Bypassing Detection on BSD TCP/IP Stack
Consider a scenario where a Certified Ethical Hacker is attempting to infiltrate a company's network without being detected. The hacker intends to use a stealth scan on a BSD-derived TCP/IP stack, but he suspects that the network security devices may be able to detect SYN packets. Based on this information, which of the following methods should he use to bypass the detection mechanisms and why?
Community Votes
83% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of specific TCP flag combinations used in stealth scanning and their interaction with different TCP/IP stack implementations, particularly the BSD behavior regarding invalid packets.
This question examines stealth scanning techniques against BSD-derived TCP/IP stacks, specifically focusing on the ACK Flag Probe Scan. It establishes why this method is preferred over other scans to avoid detection by security devices.
Many candidates choose Xmas Scan (B) or Maimon Scan (A), overlooking that these rely on FIN/RST responses which are handled differently or detected more easily than the ACK probe's exploitation of the BSD stack's lack of RST response to non-established connections.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is D because the ACK Flag Probe Scan is specifically designed to exploit quirks in BSD-derived TCP/IP stacks. When an ACK packet is sent to a port that did not initiate a connection, a standard BSD stack typically ignores it (sending no response), whereas a properly implemented stack should send a RST. This lack of response allows the hacker to map stateful firewalls and distinguish between filtered and unfiltered ports without completing a handshake, thus evading detection mechanisms that log established connections.Why the Other Options Are Wrong
Option A (Maimon Scan) uses FIN/ACK but is less effective against modern filters that drop unexpected flags. Option B (Xmas Scan) sets FIN, PSH, and URG bits; while stealthy, it relies on the target sending RST for closed ports, which can be logged or detected by IDS signatures looking for unusual flag combinations. Option C (TCP Connect/Full-Open Scan) completes the three-way handshake, making it highly visible to logs and IDS systems, defeating the purpose of a 'stealth' scan.Community Comment Notes
Community consensus heavily favors option D. As user NikoTomas noted, "Key to choosing the correct answer is BSD-based TCP/IP stack," highlighting that the specific behavior of the stack dictates the best stealth technique. User Dogeo also pointed out that the Maimon scan exploits BSD handling but acknowledged the ACK probe's superiority in this context. The majority correctly identified that the ACK probe's ability to bypass stateful inspection by not establishing a connection makes it the optimal choice for evading detection on BSD systems.Exam Strategy
When encountering questions about stealth scanning, always look for keywords like 'BSD-derived TCP/IP stack' or 'stateful firewall.' These clues point towards scans that do not complete a full handshake, such as the ACK Flag Probe or Null/FIN/Xmas scans, depending on the specific stack behavior described.
Frequently Asked Questions
Why is ACK Flag Probe better than Xmas Scan for BSD stacks?
ACK probes often elicit no response from BSD stacks if the port isn't part of an established session, making them harder to detect via logging compared to Xmas scans which may trigger RST responses.
Does the ACK scan complete a handshake?
No, it sends only the ACK flag. Since no prior SYN was sent, the connection is not established, allowing it to evade stateful firewalls that track full handshakes.