Why Does Nmap SYN Scan Show No Open Ports but Connect Scan Shows Port 443 Open?
A penetration tester discovers that an Nmap SYN scan against a target host returns no open ports, but a TCP connect scan reveals port 443 open. Which of the following is the most likely reason for this discrepancy?
Quick Answer
The answer is a network firewall performing stateful inspection that drops unsolicited SYN packets while allowing established connections. This discrepancy occurs because a SYN scan sends only a raw SYN packet and waits for a SYN-ACK to indicate an open port, but a stateful firewall sees this as an unsolicited new connection attempt and silently drops the packet, making the port appear closed or filtered. In contrast, a TCP connect scan completes the full three-way handshake (SYN, SYN-ACK, ACK), which the firewall recognizes as a legitimate established session and permits through, revealing port 443 as open. On the CEH exam, this scenario tests your understanding of how stateful firewalls differ from stateless ones and how scan types interact with packet filtering. A common trap is assuming both scans should yield identical results, but the key is that SYN scans never finish the handshake, so they evade application-layer logging but also trigger stateful drops. Memory tip: think “SYN is stealthy but gets stonewalled by stateful walls; Connect completes the dance, so the firewall gives it a chance.”
⚠ Common exam trap
Test-takers frequently assume a host-based firewall is the cause, but stateful network firewalls specifically differentiate between incomplete SYN probes and full TCP handshakes, making option B the correct answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A network firewall is performing stateful inspection and dropping unsolicited SYN packets while allowing established connections.
The discrepancy occurs because a network firewall is performing stateful inspection. It drops unsolicited SYN packets (the first step of a SYN scan) but allows full TCP connections (SYN, SYN-ACK, ACK) to complete, as the connect scan establishes a full three-way handshake. This behavior is typical of stateful firewalls that track connection state and only permit packets belonging to established sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The target host has a host-based firewall that drops SYN packets but allows full connections.
Why it's wrong here
Host-based firewalls typically treat SYN packets the same as any other TCP packet; they don't distinguish half-open vs. full connection.
- ✓
A network firewall is performing stateful inspection and dropping unsolicited SYN packets while allowing established connections.
Why this is correct
Stateful firewalls track connections; a SYN scan sends unsolicited SYN packets that may be dropped, while a connect scan completes the handshake and appears as a normal connection.
- ✗
The target host has ICMP filtering enabled, preventing Nmap from identifying it as online.
Why it's wrong here
ICMP filtering would affect ping sweeps, not TCP scans; Nmap uses TCP probes to determine host status regardless of ICMP.
- ✗
Nmap's SYN scan requires root privileges, and the tester ran it without sudo.
Why it's wrong here
If the tester ran SYN scan without root, Nmap would fall back to connect scan automatically, not return no open ports.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, you discover that an internal web server responds to ICMP echo requests but does not respond to TCP SYN scans on port 80. However, when you browse to the server's IP using a browser, the web page loads successfully. What is the most likely reason for this behavior?
medium- A.A stateful firewall is blocking inbound SYN packets to port 80 but allowing responses to outbound connections.
- B.The web server is running on a non-standard port that you did not scan.
- C.The server's TCP/IP stack is misconfigured and does not respond to SYN scans.
- ✓ D.A web application firewall is blocking the SYN scan traffic.
Why D: A Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) is designed to detect and block malicious traffic patterns, including port scanning attempts (e.g., rapid SYN packets, specific flags, or lack of subsequent application-layer data), while allowing legitimate browser traffic. These systems analyze traffic patterns and application-layer characteristics to differentiate between a scan and normal user activity. While a WAF primarily operates at Layer 7, many modern WAFs or integrated security solutions include Layer 3/4 capabilities or are deployed in conjunction with devices that can block at the TCP layer, thus explaining why a SYN scan would be blocked but a full browser connection would succeed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.