📖 What is SYN Scan (Half-Open Scan)?
A SYN Scan (Half-Open Scan) is a stealthy port scanning technique that sends a SYN packet and waits for a SYN/ACK response. The scanner sends a RST packet instead of completing the three-way handshake, avoiding the creation of a full connection.
"This is the default scan type for Nmap (-sS). It is faster and less likely to be logged by simple application-layer logs than a full TCP connect scan."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of SYN Scan (Half-Open Scan)?
- ▸ Interrupts the TCP three-way handshake by sending a RST packet after receiving a SYN/ACK, preventing a full session establishment.
- ▸ Utilizes the Nmap -sS flag, which is the default scan type due to its balance of speed and stealth.
- ▸ Determines port status based on responses: SYN/ACK indicates open, RST/ACK indicates closed, and no response typically indicates filtered.
- ▸ Requires administrative or root privileges because it involves crafting raw packets rather than using the operating system's standard network API.
- ▸ Avoids application-layer logging because the connection is never fully opened, though it remains visible to network-layer security tools.
🎯 How does SYN Scan (Half-Open Scan) appear on the PT0-002 Exam?
You may be asked to identify the most stealthy scanning method to use when a target's application logs are monitored, but network-level IDS is not a primary concern.
A scenario might describe a requirement to scan a large range of ports quickly without completing full TCP connections; you must select the -sS flag.
Expect questions comparing the SYN scan to the TCP Connect scan, focusing on the difference in privilege requirements and the resulting log footprint.
❓ Frequently Asked Questions
Why does a SYN scan require root or administrator privileges?
Standard users cannot create raw sockets to manually craft TCP packets. Because a SYN scan must send a RST packet instead of the OS-managed ACK, it requires low-level network access.
Is a SYN scan completely invisible to security software?
No. While it bypasses application logs, modern Intrusion Detection Systems (IDS) and firewalls easily detect the pattern of many SYN packets followed by RSTs as a port scan.
What happens if Nmap is run as a non-privileged user?
If the user lacks the necessary privileges for a SYN scan (-sS), Nmap will automatically default to a TCP Connect scan (-sT), which completes the full handshake.