Host Discovery with TCP SYN Ping Scan
A penetration tester was assigned to scan a large network range to find live hosts. The network is known for using strict TCP filtering rules on its firewall, which may obstruct common host discovery techniques. The tester needs a method that can bypass these firewall restrictions and accurately identify live systems. What host discovery technique should the tester use?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of alternative host discovery methods, highlighting the common trap of relying on ICMP ECHO scans which are typically blocked by firewalls.
This page explains why the TCP SYN Ping Scan is the correct host discovery technique for bypassing strict firewall filtering compared to ICMP or UDP methods. It establishes that half-open scanning provides a reliable way to detect live hosts when standard protocols are obstructed.
Candidates often choose ICMP ECHO Ping Scan because it is the most basic and well-known method for host discovery, failing to account for the specific constraint of strict TCP filtering rules.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The TCP SYN Ping Scan (Option C) is the optimal choice because it leverages the TCP three-way handshake to determine if a host is alive without completing the connection. By sending a SYN packet and analyzing the response—SYN/ACK indicates an open port/live host, while RST indicates a closed port—the tester can identify active systems even when ICMP traffic is dropped. This "half-open" scan is less likely to be blocked by stateful firewalls configured to allow inbound connections to specific services.Why the Other Options Are Wrong
ICMP Timestamp (A) and ICMP ECHO (B) Pings rely on Internet Control Message Protocol responses, which are frequently filtered or denied by strict firewall rules to prevent network mapping. UDP Ping Scan (D) involves sending UDP packets to closed ports to elicit ICMP Port Unreachable messages; however, many firewalls drop these error messages silently, leading to false negatives regarding host liveness.Community Comment Notes
Community consensus strongly supports Option C, noting that TCP SYN scans offer a stealthy and reliable method for detecting live hosts in restricted environments. As user Dogeo noted, this method avoids reliance on ICMP or UDP responses which are often obstructed. User krishccie highlighted that exploiting the TCP handshake allows detection without completing the full session, making it effective against filtering.Exam Strategy
Always read the constraints carefully; if a question mentions 'strict filtering' or 'firewalled', avoid ICMP-based answers unless specified otherwise. Consider protocol-level behaviors like TCP handshakes which may be permitted through firewalls where ICMP is not.
Frequently Asked Questions
Why is ICMP ECHO Ping Scan incorrect here?
ICMP ECHO pings are often blocked by strict firewall rules designed to prevent network reconnaissance, leading to missed live hosts.
How does TCP SYN Ping Scan differ from a full TCP connect scan?
TCP SYN Ping performs a half-open scan, never completing the three-way handshake, making it faster and less detectable than a full connect scan.