A SYN scan or "half-open" scan on the other hand are another way an attacker can try to enumerate ports on a system in a stealthy manner. These scans only execute the first two steps of the TCP three-way handshake. The initiating system sends TCP SYN packets as though it were requesting to open a full connection. The target system responds with a SYN-ACK packet. The initiator then sends a TCP RST (reset) packet back to the target, thereby closing the connection. The idea here is to prevent the full connection from being established since it may possibly be logged. Most of the Scanners also allow SYN scans using UDP packets in much the same manner.
Dig Deeper on Network Security Monitoring and Analysis
Related Q&A from Puneet Mehta
Find out if there's a difference between a virtual private network (VPN) concentrator and a network access server (NAS) in this explanation from our ... Continue Reading
Our network security expert explains how to keep unauthorized users from accessing your router's IP address for Internet access in this advice ... Continue Reading
If you've used MAC address restriction to control your network access on your wireless router, can you extend this to your wired network? Our ... Continue Reading