SYN Scan and Incomplete TCP Connections
A security analyst notices a large number of incomplete TCP connections (SYN_RECV) on a server. Which Nmap scan type is the MOST likely cause of this symptom?
Quick Answer
The answer is the SYN scan (-sS). This Nmap scan type is the most likely cause of a large number of incomplete TCP connections in the SYN_RECV state because it deliberately aborts the three-way handshake: it sends a SYN packet, and upon receiving a SYN/ACK from the server, it immediately replies with a RST instead of completing the handshake with an ACK. This leaves the server waiting for the final ACK, creating a half-open connection that remains in the SYN_RECV queue. On the Certified Ethical Hacker CEH exam, this question tests your understanding of stealth scanning techniques and their network footprint—a common trap is confusing SYN scan with a full connect scan (-sT), which completes the handshake and leaves no half-open connections. A useful memory tip: think “SYN sent, SYN/ACK received, RST sent—connection left half-open, hence SYN_RECV.”
⚠ Common exam trap
Many candidates confuse SYN scan with TCP Connect scan, assuming both complete the handshake, but SYN scan deliberately avoids the final ACK to remain stealthy, leaving the connection half-open in SYN_RECV.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN scan (-sS)
A SYN scan (-sS) sends a SYN packet to initiate a TCP handshake and, upon receiving a SYN/ACK, sends a RST to tear down the connection before it completes. This leaves the server with half-open connections in the SYN_RECV state because the three-way handshake is never finished. The large number of incomplete connections directly matches the behavior of a SYN scan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SYN scan (-sS)
Why this is correct
SYN scan sends SYN and stops after receiving SYN-ACK, leaving the connection half-open (SYN_RECV).
- ✗
Ping sweep (-sn)
Why it's wrong here
Ping sweep only sends ICMP or TCP pings, not SYN packets to ports.
- ✗
TCP Connect scan (-sT)
Why it's wrong here
TCP Connect scan completes the handshake, resulting in ESTABLISHED connections, not SYN_RECV.
- ✗
UDP scan (-sU)
Why it's wrong here
UDP scan uses UDP packets, not TCP, so it does not cause SYN_RECV states.
Visual reference
Go deeper
Related to this question
Learn chapter
Malware Threats
Key term
Port Scanning Techniques
Port scanning techniques are methods used to probe a computer or network to discover which network ports are open and which services are running on those ports.
Key term
Active reconnaissance
Active reconnaissance is the process of directly interacting with a target system or network to gather information, often through scanning and probing.
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, a security analyst observes that Nmap SYN scans to a target server are not returning any results, but TCP connect scans succeed. The server is running an IDS. Which evasion technique is the analyst MOST likely encountering?
hard- ✓ A.The IDS is dropping packets with the SYN flag set
- B.The server is using a firewall that blocks all inbound SYN packets
- C.The analyst's packets are being fragmented, causing them to be dropped
- D.The target is using a honeypot that responds to all connection attempts
Why A: The IDS is configured to drop packets with only the SYN flag set, which is the hallmark of a SYN scan. This evasion technique forces the attacker to use a full TCP connect scan (which completes the three-way handshake) to bypass the IDS detection. The IDS drops the initial SYN packet, preventing the scan from receiving any response, while a full connect scan is allowed because it mimics legitimate traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.