Xmas Scan

what are the flags set in a XMAS scan /

There are many sources which say FIN URG and PSH are set. ECCOUNCIL study material also says this .

Where are some say that all Flags are set.

Can any one validate this for me ..

Thansk

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

JDMurray

All of the flags are set. The TCP header is "lit up" like an Xmas tree. Some descriptions say it's every other flag bit set, but I learned it as all flag bits ON.

Sie

It is all, but why not use tcpdump or wireshark and capture a packet to see for yourself?

the_Grinch

Funny thing is in looking through the two CEH books I have been reading you get two different answers. ExamCram says every other bit (PSH URG FIN) and the Official EC-Council Study Guide says all (SYN ACK RST PSH URG FIN). Going with the official guide and JD!

darkerosxx

For CEH, you should know about doing scans with nmap. When you specify the XMAS scan option in nmap, it sets the FIN, PSH, and URG flags.

On another note, I had to word this differently than I normally would as apparently this forum has security for certain types of commands entered. When I typed in the XMAS scan command, it wouldn't let me submit this post. After I removed it, it submitted.

JDMurray

I just ran an XMAS scan using the latest namp v4.76 and Wireshark showed only the FIN, PSH, and URG flags set. You can set all six flags using the command line, but I don't see a prepackaged name for this scan.

And TE's security filters remove anything that looks like an intrusion attempt (you'll see a 403 error), so nmap's command lines options are definitely not displayable.