Bypassing Detection on BSD TCP/IP Stack

312-50v13 By islever Editorial Last updated

Scanning Networks

Short answer

D The ACK Flag Probe Scan is used because it exploits the vulnerabilities within the BSD-derived TCP/IP stack to bypass detection mechanisms.

Question

Consider a scenario where a Certified Ethical Hacker is attempting to infiltrate a company's network without being detected. The hacker intends to use a stealth scan on a BSD-derived TCP/IP stack, but he suspects that the network security devices may be able to detect SYN packets. Based on this information, which of the following methods should he use to bypass the detection mechanisms and why?
  1. Maimon Scan, because it is very similar to NULL, FIN, and Xmas scans, but the probe used here is FIN/ACK
  2. Xmas Scan, because it can pass through filters undetected, depending on the security mechanisms installed
  3. TCP Connect/Full-Open Scan, because it completes a three-way handshake with the target machine
  4. ACK Flag Probe Scan, because it exploits the vulnerabilities within the BSD-derived TCP/IP stack Correct Answer

Key Takeaways

The question tests knowledge of specific TCP flag combinations used in stealth scanning and their interaction with different TCP/IP stack implementations, particularly the BSD behavior regarding invalid packets.

This question examines stealth scanning techniques against BSD-derived TCP/IP stacks, specifically focusing on the ACK Flag Probe Scan. It establishes why this method is preferred over other scans to avoid detection by security devices.

Common mistake: Many candidates choose Xmas Scan (B) or Maimon Scan (A), overlooking that these rely on FIN/RST responses which are handled differently or detected more easily than the ACK probe's exploitation of the BSD stack's lack of RST response to non-established connections.

Expert Analysis

Why the Answer Is Correct

The correct answer is D because the ACK Flag Probe Scan is specifically designed to exploit quirks in BSD-derived TCP/IP stacks. When an ACK packet is sent to a port that did not initiate a connection, a standard BSD stack typically ignores it (sending no response), whereas a properly implemented stack should send a RST. This lack of response allows the hacker to map stateful firewalls and distinguish between filtered and unfiltered ports without completing a handshake, thus evading detection mechanisms that log established connections.

Why the Other Options Are Wrong

Option A (Maimon Scan) uses FIN/ACK but is less effective against modern filters that drop unexpected flags. Option B (Xmas Scan) sets FIN, PSH, and URG bits; while stealthy, it relies on the target sending RST for closed ports, which can be logged or detected by IDS signatures looking for unusual flag combinations. Option C (TCP Connect/Full-Open Scan) completes the three-way handshake, making it highly visible to logs and IDS systems, defeating the purpose of a 'stealth' scan.

Community Comment Notes

Community consensus heavily favors option D. As user NikoTomas noted, "Key to choosing the correct answer is BSD-based TCP/IP stack," highlighting that the specific behavior of the stack dictates the best stealth technique. User Dogeo also pointed out that the Maimon scan exploits BSD handling but acknowledged the ACK probe's superiority in this context. The majority correctly identified that the ACK probe's ability to bypass stateful inspection by not establishing a connection makes it the optimal choice for evading detection on BSD systems.

Exam Strategy

When encountering questions about stealth scanning, always look for keywords like 'BSD-derived TCP/IP stack' or 'stateful firewall.' These clues point towards scans that do not complete a full handshake, such as the ACK Flag Probe or Null/FIN/Xmas scans, depending on the specific stack behavior described.

Frequently Asked Questions

Why is ACK Flag Probe better than Xmas Scan for BSD stacks?

ACK probes often elicit no response from BSD stacks if the port isn't part of an established session, making them harder to detect via logging compared to Xmas scans which may trigger RST responses.

Does the ACK scan complete a handshake?

No, it sends only the ACK flag. Since no prior SYN was sent, the connection is not established, allowing it to evade stateful firewalls that track full handshakes.

More 312-50v13 FAQ →

Community Votes

D
83%
B
17%

83% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Dogeo 👍 2 Answered D
    The Maimon scan is often used to bypass firewalls by sending FIN/ACK packets, exploiting the way the BSD-derived TCP/IP stack handles these packets
  2. NikoTomas 👍 1 Answered B
    Correct is B - Xmas All these three scans - A (Maimon), B (Xmas) and D (ACK scan) - are suitable for stealth scanning avoiding FW and IDS detection as connection is not properly established and logged (many firewalls and IPSes logs only established connections, not failed attempts). Key to choosing the correct answer is BSD-based TCP/IP stack in the question: In CEH v11 and v12 EC-Council specifically notes: "Xmas tree scans can be useful on systems like BSD/UNIX because these platforms follow RFC 793, which defines how to handle packets with unusual flag combinations like FIN, URG, and PSH." Xmas Scan Behavior: • Sends TCP packets with FIN, URG, and PSH flags set. • RFC 793 says: o If the port is closed, the host should reply with RST o If the port is open or filtered, there should be no response BSD stacks behave exactly this way, making it possible to infer: • Closed port → Responds with RST • Open/Filtered port → No response
  3. marcel9999 👍 1 Answered D
    answer B get detected right away, so D is correct
  4. MHafizC 👍 2 Answered D
    ACK Flag Probe Scan

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide