CEH Footprinting, Reconnaissance and Scanning Practice Question

A security analyst runs the following command: hping3 -S -p 80 -c 1 192.168.1.1. The response received is an RST/ACK packet. What does this indicate about port 80 on the target?

⚠ Common exam trap

Test-takers frequently confuse a RST/ACK response with a filtered port or assume it indicates a firewall blocking the port, but in TCP, a closed port actively sends RST/ACK, whereas a firewall typically drops the packet silently.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The port is closed

When hping3 sends a SYN packet to a closed port, the target responds with an RST/ACK packet per TCP RFC 793. This indicates that the port is reachable but no service is listening on it, hence the immediate reset.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The port is open and listening
Why it's wrong here
An open port would respond with SYN/ACK.
✗
The port is filtered by a firewall
Why it's wrong here
A filtered port typically drops the packet or responds with no reply or ICMP unreachable.
✓
The port is closed
Why this is correct
RST/ACK indicates the port is closed.
✗
The port is in a TIME_WAIT state
Why it's wrong here
TIME_WAIT is a TCP state that would not produce an RST/ACK from a scanning perspective.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question