Whats the difference between a XMAS Tree scan and an Inverse TCP scan using the FIN, URG, and PSH flags? Are they the same thing?

XMAS Tree scans are designed to manipulate the PSH, URG and FIN flags of the TCP header. The Inverse TCP scan uses TCP probe packets using the FIN, URG, and PSH flags set, or with no flags at all which is known as a Null scan. That I understand, but I dont know what difference if any there is between the two. Cant seem to find an answer here or anywhere.

I ask for legal purposes, and help is greatly appreciated. First question on here, I apologize for any mistakes in conduct in the question or tags.

1 Answer 1


An XMAS scan has PSH and URG and FIN set, i.e. all three flags at once. An inverse TCP scan has PSH or URG or FIN or none flag set, i.e. a single flag or no flag.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .