TCP Maimon Scan Technique Analysis
Sam is a penetration tester hired by Inception Tech, a security organization. He was asked to perform port scanning on a target host in the network. While performing the given task, Sam sends FIN/ACK probes and determines that an RST packet is sent in response by the target host, indicating that the port is closed. What is the port scanning technique used by Sam to discover open ports?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of specific TCP flag combinations in port scanning; the trap is confusing FIN/ACK probes with standard ACK scans or Xmas scans.
This page explains the TCP Maimon scan, a stealthy port scanning technique using FIN/ACK probes to detect closed ports via RST responses. It clarifies why this method differs from other TCP flag-based scans like Xmas or NULL scans.
Candidates often select ACK flag probe scan (D) because ACK is present, but fail to recognize that the combination of FIN and ACK specifically defines the Maimon scan behavior where an open port ignores the packet while a closed port sends RST.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is C, TCP Maimon scan. This technique involves sending a TCP segment with both the FIN and ACK flags set. According to RFC 793, if the target port is closed, it responds with a RST packet. If the port is open, the host typically ignores the FIN flag (since the connection isn't established via SYN), resulting in no response or a timeout. The scenario explicitly states Sam sends FIN/ACK probes and receives RST packets indicating closed ports, which is the defining characteristic of the Maimon scan.Why the Other Options Are Wrong
Option A, Xmas scan, uses FIN, PSH, and URG flags, not FIN/ACK. Option B, IDLE/IPID header scan, relies on idle zombie hosts and IP identification fields, not direct FIN/ACK probing. Option D, ACK flag probe scan, uses only the ACK flag to map stateful firewall rules, not to determine open/closed status via RST responses in the same manner as the Maimon scan described.Community Comment Notes
Community consensus strongly supports option C. As user killwitch noted, "FIN/ACK probes followed by RST response follows exactly the Maimon scan definition." Another commenter, marcel9999, highlighted that this technique is similar to NULL and FIN scans but specifically uses the FIN/ACK probe combination. User Dogeo simply confirmed, "In a TCP Maimon scan, the attacker sends a FIN/ACK probe to the target," aligning perfectly with the exam scenario.Official Reference
Exam Strategy
Focus on memorizing the specific flag combinations for each TCP scan type: NULL (none), Xmas (FIN, PSH, URG), Fin (FIN), and Maimon (FIN, ACK). Understanding the expected response (RST vs. No Response) for open vs. closed ports is critical for distinguishing between these stealth scans.
Frequently Asked Questions
What is the difference between Maimon and Xmas scans?
Maimon scans use FIN/ACK flags, while Xmas scans use FIN/PSH/URG flags. Both aim to evade logging but have different flag compositions.
Why does an open port not respond to a Maimon scan?
An open port ignores the FIN flag because the TCP handshake was never completed. It waits for further data or a reset, whereas a closed port immediately sends a RST.