The TCP Half Open Scan, also known as a SYN scan, is a technique used to discover open ports on a remote system without completing the full TCP connection. This technique relies on executing the first half of a TCP three-way handshake to determine if a port is open.

How It Works

In the TCP protocol, a connection between two hosts is established through a process known as a three-way handshake, which involves three steps:

1. SYN: The host initiating the connection sends a SYN (synchronize) packet to the destination server.
2. SYN-ACK: If the port on the destination server is open, the server responds with a SYN-ACK (synchronize-acknowledge) packet.
3. ACK: The host that initiated the connection sends an ACK (acknowledge) packet to complete the connection.

In a TCP Half Open Scan, the host performing the scan sends only the initial SYN packet and waits for the SYN-ACK response. If it receives a SYN-ACK packet, it means the port is open. However, the host never sends the final ACK packet, thus interrupting the connection process before it is completed. This leaves the connection “half open,” hence the name of the technique.

Advantages of TCP Half Open Scan

• Discretion: Because the connection is never completed, this technique is less noticeable in system logs compared to a full TCP connection. This can make the TCP Half Open Scan a preferred method for stealthy scanning.
• Speed: The lack of a requirement to complete the three-way handshake makes this technique faster than other scanning methods.
• Efficiency: This technique allows for the detection of open ports with minimal network and system resource usage.

Disadvantages and Risks

• Detectability: Despite its more discreet nature compared to other techniques, the TCP Half Open Scan can still be detected by advanced Intrusion Detection Systems (IDS).
• Limitations: Some firewalls and security systems may be configured to block or limit incomplete SYN packets, reducing the effectiveness of this technique.

Common Uses

The TCP Half Open Scan is commonly used in:

• Security Testing: Cybersecurity professionals use this technique to assess network security and identify open ports that could be exploited by malicious actors.
• Vulnerability Assessments: Security analysts employ this technique to identify potential weaknesses in systems and networks.
• Reconnaissance by Malicious Actors: Hackers may use this technique to gather information about target networks without drawing too much attention.

Conclusion

The TCP Half Open Scan represents an effective and discreet method for identifying open ports on a remote system, leveraging the first half of the TCP three-way handshake. Despite its advantages in terms of speed and discretion, it must be used with caution due to potential countermeasures implemented by modern security systems.