How exactly does the Inverse TCP flag scan run and can we run it as a stealth scan?

1 Answer 1


The Inverse TCP flag scan executes as follows.

Attackers send TCP probe packets with a TCP flag (FIN, URG, PSH) set, or with no flags.

When the port is open, the attacker doesn't get any response from the host, whereas when the port is closed, he or she receives the RST from the target host.

When Port is Open

 Attacker--------- (FIN/URG/PSH/NULL) ------------------ >  Victim  
                       X < -------- No Response --------

When Port is Closed

Attacker--------- (FIN/URG/PSH/NULL) ------------------ >  Victim  
      < -------------- RST / ACK ----------------------

Security mechanisms such as firewalls and IDS detect the SYN packets sent to the sensitive ports of the targeted hosts. But the probe packets enabled with TCP flags can pass through filters undetected, depending on the security mechanisms installed. Inverted Technique is probing a target using a half-open SYN flag because the closed ports can only send the response back.


  • Avoids many IDS and logging systems, highly stealthy


  • Needs raw access to network sockets, thus requiring super-user privileges

  • Mostly effective against hosts using a BSD-derived TCP/IP stack (not effective against Microsoft Windows hosts, in particular)

Inverse TCP flag scanning is known as FIN, URG, PSH scanning based on the flag set in the probe packet. If there is no flag set, it is known as null scanning.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .