I'm reading an Information Security book and am faced with the question:
Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())?
Why might it be?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Nmap, like any adversary tool, can be fingerprinted by Intrusion Detection Systems (IDS). As such, any of Nmap's techniques are generally classified as an attack by these modern tools -- especially Next-generation Firewall (NGFW) technologies, or the bleeding-edge equivalents of NGFWs.
Additionally, information sharing alliance centers (ISACs) are sharing Cyber Threat Intelligence (CTI) indicators (often shown as Indicators of Compromise, or IoCs) that involve either
Which book are you referring to? Given the context, it appears that the author is discussing how SYN scans are potentially more noisy on a network than TCP connect() scans. This is because the SYN scan does not complete the full TCP handshake. Again, IDS/IPS, UTM, NGFW, and CTI defensive techniques will detect the SYN scan, much like many other Nmap methods and many other network penetration-testing tools and techniques.
A stealth scan would not necessarily attract more attention than a connect scan, the whole point of a stealth scan is to attract less.
What this book may be implying is that a stealth scan is more of a concern than a connect scan. Connect scans can be used to simply gain information about what is online, they don't try to hide what they are doing. An IDS/IPS system should pick one up right away. If an attacker is running a connect scan they are probably less sophisticated/skilled, and therefore less of a threat. If someone is running a stealth scan they are much more likely to know what they are doing, and be harder to detect.
TCP connect scan establishes full connection with target as compare to SYN.Because TCP stealth(SYN) scan completes half connecion with target.Also in TCP connect scan syn,syn-ack,and RST packets are send. In case of TCP SYN only RST is not send and continue establishing connection.