I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not).
What would help me to better understand them is a clear association to the flags returned by the host. Therefore I created the list below and would appreciate to have it doubled checked by you guys:
State Response Open SYN/ACK (SYN probe) Closed RST (SYN probe) Filtered No Answer or ICMP Type 3 and 13 (SYN probe) Unfiltered No Answer or ICMP Type 3 and 13 (ACK probe) Open/Filtered No Answer (UDP, FIN, NULL, XMAS probes) Closed/Filtered No Answer or RST (Idle Scan)