Exam 312-50v11 topic 1 question 170 discussion

C is the correct answer. Source: https://nmap.org/book/scan-methods-maimon-scan.html

EC-Council v11 pg.309 TCP Maimon scan This scan technique is very similar to NULL, FIN, and Xmas scan, but the probe used here is FIN/ACK. In most cases, to determine if the port is open or closed, the RST packet should be generated as a response to a probe request. However, in many BSD systems, the port is open if the packet gets dropped in response to a probe. Nmap interprets a port as open|filtered when there is no response from the Maimon scan probe even after many retransmissions. The port is closed if the probe gets a response as an RST packet. The port is filtered when the ICMP unreachable error (type 3, code 1, 2, 3, 9, 10, or 13) is returned from the target host. In Zenmap, the -sM option is used to perform the TCP Maimon scan. Figure 3.45: TCP Maimon scan.

It is the TCP Maimon scan that uses FIN/ACK probe. The Ack flag probe scan uses Ack probe. Hence the Answer is C

https://nmap.org/book/scan-methods-maimon-scan.html TCP Maimon Scan (-sM) The Maimon scan is named after its discoverer, Uriel Maimon. He described the technique in Phrack Magazine issue #49 (November 1996). Nmap, which included this technique, was released two issues later. This technique is exactly the same as NULL, FIN, and Xmas scan, except that the probe is FIN/ACK. According to RFC 793 (TCP), a RST packet should be generated in response to such a probe whether the port is open or closed. However, Uriel noticed that many BSD-derived systems simply drop the packet if the port is open.

The correct option is C: tcp Maimon scan

it is D because he sends a ACK firts, that is inside an ACK flag probe scan it cant be tcp maimon scan, because the attacker will send a syn first

TCP Maimon Scan - send FIN/ACK probes, and if there is no response the port is Open|Filtered； but if an RST packet is sent in response, then the port is closed. # Nmap -sM -v <target IP address> (P.309/293)

Correct answer is C, Maimon attack. Known for making use of FIN/ACK flags

Correct answer is C

The answer is C

C is the answer

That ' C for sure. Fin/Ack=Maimon

answer is C

TCP Maimon Scan.

it says FIN/ACK,, answer is TCP Maimon Scan

the correct anwser is TCP-Maimon-Scan!!!

C is correct. Maimon Scan.