TCP 3-Way Handshake & Stealth Port Scan (SYN/FIN/Xmas/Null/ACK) Visualizer (2026)

In a full TCP 3-way handshake (`-sT`), the OS kernel sends `SYN`, receives `SYN/ACK`, and completes the connection with `ACK`, which causes `accept()` to return and writes an entry in application-layer logs. In a SYN scan (`-sS`), Nmap crafts raw packets and immediately sends a `RST` (Reset) as soon as `SYN/ACK` arrives, tearing down the embryonic connection before the application layer ever sees it—though modern stateful firewalls and EDRs still log it.

According to RFC 9293 (formerly RFC 793) Section 3.10.7.4, if a packet arrives without the `SYN`, `RST`, or `ACK` bits set, a **closed** port must respond with a `RST` packet, whereas an **open** port must silently ignore and drop the out-of-state segment. By sending zero flags (Null), just `FIN`, or `FIN+PSH+URG` (lit up like a Christmas tree), the scanner identifies closed ports that reply with `RST` and marks silent ports as `open|filtered`.

Microsoft Windows, Cisco IOS, and several BSD variants do not strictly follow RFC 9293's silent-drop rule for malformed flag combinations—their TCP stacks reply with `RST` to FIN, Null, and Xmas probes whether the port is open or closed, making every port appear `closed` to Nmap.

An ACK scan never determines whether a port is `open` or `closed`, because both open and closed ports on an unfiltered host reply to an unsolicited `ACK` with a `RST` packet. Instead, `-sA` maps firewall rulesets: ports that return `RST` are `unfiltered` (allowed through the firewall), while ports that return nothing or ICMP Type 3 Code 13 are `filtered` by a stateful inspection firewall.

Byte offset 13 of the TCP header holds the 8 control flags: `CWR(128) ECE(64) URG(32) ACK(16) PSH(8) RST(4) SYN(2) FIN(1)`. An Nmap Xmas scan sets `FIN (1) + PSH (8) + URG (32) = 41` in decimal, which equals `0x29` in hexadecimal (`00101001` in binary).