TCP FIN, NULL and Xmas scan

These three types of scans exploit a vulnerability in the TCP protocol standard to distinguish open and closed ports. The standard states that "if the state of the target port is CLOSED... an incoming segment without an RST causes an RST to be sent in response".

When systems are scanned according to this rule, any packet that does not have SYN, RST, or ACK bits will result in a returned RST if the port is closed and no response if the port is open. As long as these three bits are not included, any combination of the others (FIN, PSH, and URG) is acceptable. Nmap utilizes this with three scan types:

• Null scanning (-sN) Does not set any bits (TCP flag header is 0)
• FIN scanning (-sF) Sets only the TCP FIN flag.
• Xmas scanning (-sX) sets the FIN, PSH, and URG flags, illuminating the packet like a Christmas tree.

These three types of scans work exactly the same way except for the TCP flags used in them. The responses are handled as follows.

• No response received (even after resending) -> open|filtered
• The answer is TCP RST packet -> the port is closed
• Any other answer -> filtered

The key advantage of these scanning types is that they can bypass certain firewalls and packet filters. Such firewalls attempt to block incoming TCP connections (while allowing outgoing connections) by blocking all TCP packets with the SYN bit set and the ACK bit cleared. NULL, FIN, and Xmas scans remove the SYN bit and thus pass straight through them.