I'm reading an Information Security book and am faced with the question:

Why may nmap stealth scans(SYN) attract more attention than simple connect scans(TCP connect())?

Why might it be?

  • 2
    Asking if your answer is correct is not the purpose of a StackExchange. It was edited to reflect the question you were trying to answer so that responses will benefit others with the same question in the future. – RoraΖ Feb 23 '15 at 17:18
  • 1
    1. What research have you done? 2. What precisely do you mean by a nmap stealth scan? There are many kinds of scans nmap can do, and they will have different characteristics. The phrase "stealth scan" could refer to any number of things (see, e.g., the nmap man page, which does not describe any of its scans as "stealth scan"; it does imply that some scanning methods are stealthier than others). Please edit your question to add more details: merely copy-pasting a one-line question from a test-prep book rarely leads to a good fit for the StackExchange sort of site. – D.W. Feb 23 '15 at 19:57
  • I've added some additional information to the question, for my side this question is resolved. - There is a good answer below. – sereGkaluv Feb 24 '15 at 7:48

Nmap, like any adversary tool, can be fingerprinted by Intrusion Detection Systems (IDS). As such, any of Nmap's techniques are generally classified as an attack by these modern tools -- especially Next-generation Firewall (NGFW) technologies, or the bleeding-edge equivalents of NGFWs.

Additionally, information sharing alliance centers (ISACs) are sharing Cyber Threat Intelligence (CTI) indicators (often shown as Indicators of Compromise, or IoCs) that involve either

  1. IP addresses that original attacker traffic, such as Nmap, and thus would be blocked or detected by an organization that has a CTI team, consumes CTI feeds, or has products or service that include a CTI element
  2. Network traffic signatures, such as Snort (N.B., Snort is a very popular free, open-source IDS) rules, that contain information about how Nmap works -- especially Nmap's "stealthy" scans, e.g., NULL, FIN, ACK, Window, SYN, et al

Which book are you referring to? Given the context, it appears that the author is discussing how SYN scans are potentially more noisy on a network than TCP connect() scans. This is because the SYN scan does not complete the full TCP handshake. Again, IDS/IPS, UTM, NGFW, and CTI defensive techniques will detect the SYN scan, much like many other Nmap methods and many other network penetration-testing tools and techniques.

  • 2
    Yes, you are right about the context (SYN and TCP connect()). So if I understand you in a right way - SYN scans are more noticeable just because they abort 3-way handshakes? – sereGkaluv Feb 23 '15 at 17:32
  • 1
    That's exactly correct. Without timely follow-up, a stateful firewall or IDS will often flag SYN traffic as malicious – atdre Feb 23 '15 at 17:39
  • 4
    Historical note: "stealth" refers to application logs, which will not show these connection attempts since the connection is aborted before the kernel hands it off to userland. – bonsaiviking Feb 23 '15 at 18:26

A stealth scan would not necessarily attract more attention than a connect scan, the whole point of a stealth scan is to attract less.

What this book may be implying is that a stealth scan is more of a concern than a connect scan. Connect scans can be used to simply gain information about what is online, they don't try to hide what they are doing. An IDS/IPS system should pick one up right away. If an attacker is running a connect scan they are probably less sophisticated/skilled, and therefore less of a threat. If someone is running a stealth scan they are much more likely to know what they are doing, and be harder to detect.

  • With old and/or basic firewalls stealth scanning would bypass logging. They are no longer hard to detect. The default in using nmap is also a stealth scan, so I would not say they are more likely to know what they're doing. – SilverlightFox Feb 24 '15 at 9:18

TCP connect scan establishes full connection with target as compare to SYN.Because TCP stealth(SYN) scan completes half connecion with target.Also in TCP connect scan syn,syn-ack,and RST packets are send. In case of TCP SYN only RST is not send and continue establishing connection.

  • 1
    Welcome! While your answer is correct, it doesn't add anything to the other answers. – Esa Jokinen Feb 20 '19 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.