| Scan Type | Core Flag Pattern | Key Confirmation |
|---|---|---|
| SYN | SYN only | SYN-ACK → RST |
| NULL | No flags | RST from closed ports |
| ACK | ACK only | RST flood |
| FIN | FIN only | RST on closed |
| XMAS | FIN+PSH+URG | RST on closed |
Detection
- Identify abnormal flag pattern
- Pivot by source IP
- Confirm multi-port targeting
- Confirm short time interval
- Observe RST burst responses