You are a Network Security Analyst monitoring the perimeter segment of an enterprise network. The environment includes a public-facing UNIX-based web server (10.0.0.15) residing in the DMZ.
Your external Intrusion Detection System (IDS), running Suricata, has just generated an alert regarding potential reconnaissance activity originating from an external IP address (192.168.1.50). The firewall logs show a sudden influx of packets directed at multiple ports on the UNIX server, but the packet structure is highly unusual. You export the traffic to a PCAP file for detailed inspection in Wireshark.
Excerpt from the captured traffic (Wireshark output format):
No. Time Source Destination Protocol Length Info
1 0.00000 192.168.1.50 10.0.0.15 TCP 54 54321 → 80 [<None>] Seq=1 Win=1024 Len=0
2 0.00120 192.168.1.50 10.0.0.15 TCP 54 54321 → 22 [<None>] Seq=2 Win=1024 Len=0
3 0.00185 10.0.0.15 192.168.1.50 TCP 54 22 → 54321 [RST, ACK] Seq=1 Ack=2 Win=0 Len=0
4 0.00210 192.168.1.50 10.0.0.15 TCP 54 54321 → 443 [<None>] Seq=3 Win=1024 Len=0
* Note: The "Info" column displays [<None>] indicating an absence of standard TCP control flags.
An external attacker is probing the UNIX server (10.0.0.15) to identify open ports without establishing a full TCP connection. They are sending TCP packets with all control flags turned off. The UNIX server (following RFC 793 specifications) ignores these packets if the port is open, but sends back an RST (Reset) packet if the port is closed. In the logs above, Port 22 responded with RST, indicating it is closed, while Port 80 and 443 sent no response, implying they might be open.
This is a TCP Null Scan. It is a stealth reconnaissance technique designed to bypass rudimentary, stateless firewall rules that only look for incoming SYN packets to block external connection attempts.
A is correct: The Wireshark display filter tcp.flags==0x000 isolates packets where the TCP flag field equals exactly zero. Because a Null scan by definition contains no active flags (URG, ACK, PSH, RST, SYN, FIN are all 0), this filter perfectly isolates the malicious reconnaissance traffic.
0x004 filters for the RST (Reset) flag. This would identify the server's response to closed ports, but not the incoming scan attempt itself.0x003 filters for both SYN and FIN flags set together (0x02 + 0x01). This is a known invalid combination (SYN/FIN scan), not a Null scan.0x002 filters for the SYN flag. This is used to detect standard connection initiations or a SYN stealth scan, not a Null scan.To defend against this, the organization's border firewall or IPS must be configured to drop packets containing invalid or malformed TCP flag combinations. Modern stateful firewalls typically drop Null, FIN, and Xmas scans by default because these packets do not belong to an established, tracked connection state.
Traffic Pattern Recognition Threat actors utilize stealth scans to manipulate the TCP header. Knowing hex conversions for flags is a fundamental Blue Team skill:
0x000 = Null Scan (No flags)0x001 = FIN Scan (Only FIN flag)0x029 = Xmas Scan (FIN, PSH, URG flags)0x002 = SYN Scan / Normal Connection StartDetection vs Prevention: While Wireshark is vital for detecting the behavior post-event or during active analysis, prevention requires stateful packet inspection (SPI) at the firewall level to ensure incoming packets conform to a valid state table.
Master traffic analysis, firewall configurations, and IDS/IPS tuning.
Explore more CND simulations