SYN Scan and Incomplete TCP Connections
A security analyst notices a large number of incomplete TCP connections (SYN_RECV) on a server. Which Nmap scan type is the MOST likely cause of this symptom?
Quick Answer
The answer is the SYN scan (-sS). This Nmap scan type is the most likely cause of a large number of incomplete TCP connections in the SYN_RECV state because it deliberately aborts the three-way handshake: it sends a SYN packet, and upon receiving a SYN/ACK from the server, it immediately replies with a RST instead of completing the handshake with an ACK. This leaves the server waiting for the final ACK, creating a half-open connection that remains in the SYN_RECV queue. On the Certified Ethical Hacker CEH exam, this question tests your understanding of stealth scanning techniques and their network footprint—a common trap is confusing SYN scan with a full connect scan (-sT), which completes the handshake and leaves no half-open connections. A useful memory tip: think “SYN sent, SYN/ACK received, RST sent—connection left half-open, hence SYN_RECV.”
⚠ Common exam trap
Many candidates confuse SYN scan with TCP Connect scan, assuming both complete the handshake, but SYN scan deliberately avoids the final ACK to remain stealthy, leaving the connection half-open in SYN_RECV.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN scan (-sS)
A SYN scan (-sS) sends a SYN packet to initiate a TCP handshake and, upon receiving a SYN/ACK, sends a RST to tear down the connection before it completes. This leaves the server with half-open connections in the SYN_RECV state because the three-way handshake is never finished. The large number of incomplete connections directly matches the behavior of a SYN scan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SYN scan (-sS)
Why this is correct
A SYN scan (-sS) sends TCP SYN packets and never completes the handshake, leaving connections in SYN_RECV on the target. Half-open scans abandoned at scale produce exactly this backlog, unlike connect scans, which finish the three-way handshake.
- ✗
Ping sweep (-sn)
Why it's wrong here
A ping sweep sends ICMP echo requests, not TCP SYNs, so it cannot leave half-open connections in SYN_RECV. It is tempting because it also enumerates live hosts, but it is the right choice only when you need host discovery without port scanning, not when diagnosing TCP handshake exhaustion.
- ✗
TCP Connect scan (-sT)
Why it's wrong here
TCP Connect scan completes the full three-way handshake via the operating system, so connections reach ESTABLISHED, not SYN_RECV. It tempts because it also targets TCP ports. It would be correct where the tester lacks raw-socket privileges and must rely on the OS connect call.
- ✗
UDP scan (-sU)
Why it's wrong here
UDP scan sends UDP datagrams and never completes a TCP handshake, so it cannot leave TCP connections in SYN_RECV. It tempts because both scans probe many ports rapidly. It would be correct where the target exposes UDP services such as DNS or SNMP requiring enumeration.
Visual reference
Go deeper
Related to this question
Key term
Port Scanning Techniques
Port scanning techniques are methods used to probe a computer or network to discover which network ports are open and which services are running on those ports.
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
About these practice questions
This CEH question is part of Courseiva's 913-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, a security analyst observes that Nmap SYN scans to a target server are not returning any results, but TCP connect scans succeed. The server is running an IDS. Which evasion technique is the analyst MOST likely encountering?
hard- ✓ A.The IDS is dropping packets with the SYN flag set
- B.The server is using a firewall that blocks all inbound SYN packets
- C.The analyst's packets are being fragmented, causing them to be dropped
- D.The target is using a honeypot that responds to all connection attempts
Why A: The IDS is configured to drop packets with only the SYN flag set, which is the hallmark of a SYN scan. This evasion technique forces the attacker to use a full TCP connect scan (which completes the three-way handshake) to bypass the IDS detection. The IDS drops the initial SYN packet, preventing the scan from receiving any response, while a full connect scan is allowed because it mimics legitimate traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.