Exam 312-50v13 topic 1 question 188 discussion

TCP SYN scans can be more effective at bypassing firewalls because they exploit the TCP three-way handshake. By sending a SYN packet and analyzing the response (SYN/ACK for open ports, RST for closed ports), the tester can determine if a host is alive without completing the full handshake. This "half-open" scan is often less detectable than ICMP scans. Firewalls are often configured to allow some TCP traffic, because many services rely on it.

A TCP SYN Ping Scan is effective for bypassing strict TCP filtering rules because it sends SYN packets to a specific port, checking for a SYN-ACK response to identify live hosts. Unlike ICMP-based scans, which are often blocked by firewalls, SYN scans can work even if ICMP traffic is restricted. Firewalls may allow SYN packets through to specific services, making this technique useful in restricted environments.

In a firewalled and heavily filtered network, a TCP SYN Ping Scan is the best host discovery method. It allows a stealthy and reliable way to detect live hosts without relying on ICMP or UDP responses.