top of page

What is Stealth scan in NMAP, give the command. Also explain why it is called Stealth?

Stealth Scan is also known as SYN Scan or TCP SYN Scan because it sends only one SYN packet in the TCP Handshake process. This speed of operation and lack of communication is good for the scanner to prevent traffic analysis. Because there is no complete connection that can be analyzed. Stealth scans aim to minimize the visibility of the scanning activity and mimic normal network traffic patterns to avoid triggering alarms or raising suspicions. Note that it is easy to bypass older IDS as they are looking out for a full three way handshake, this is often no longer the case with modern IDS solutions.


Command:

nmap -sS <target>


It is called stealth because when the TCP Three-Way Handshake process is implemented, in the last step of the Handshake, instead of confirming the connection, it sends an RST scanner and resets the connection to prevent further steps and hence does its job of checking if the target is up or not without actually connecting to it.

16 views

Recent Posts

See All
bottom of page