Post cover image

September 25, 2026

Nmap Learning Series — Part 7: FIN, NULL & Xmas Scans

Nmap is much more than simply running a SYN scan and looking for open ports.

By Subrat Samantaray

3 min read

During reconnaissance, different TCP scanning techniques can reveal how a target system handles unusual TCP packets. In this part of my Nmap learning series, I explored three important techniques:

  • FIN Scan
  • NULL Scan
  • Xmas Scan

These scans are commonly referred to as stealth or inverse TCP flag scans because they do not perform a normal TCP connection.

Understanding TCP Flag Scanning

A TCP connection normally uses flags such as:

SYN
ACK
FIN
RST
PSH
URG

Nmap can manipulate these flags to create different types of scans.

Instead of initiating a normal connection, these scans send specially crafted TCP packets and analyze the target's response.

The behavior is based on how the target implements the TCP specification, particularly RFC 793.

Xmas Scan

The Xmas scan is performed using:

nmap -sX 192.168.1.1

The name comes from the packet being "lit up" with multiple TCP flags.

Nmap sends a packet with:

FIN + PSH + URG

set.

The expected behavior is:

Open port   → No response
Closed port → RST response

This makes the scan different from a normal SYN scan because it does not attempt to establish a TCP connection.

Example

nmap -sX 192.168.1.10

A simplified interpretation could look like:

PORT     STATE
22/tcp   open|filtered
80/tcp   open|filtered
443/tcp  open|filtered

The important point is that no response does not necessarily prove that a port is open. A firewall may also silently drop the packet.

NULL Scan

A NULL scan uses:

nmap -sN 192.168.1.1

Unlike the Xmas scan, the TCP packet contains no TCP flags.

TCP Flags = NONE

The expected behavior is:

Open port   → No response
Closed port → RST response

Example:

nmap -sN 192.168.1.10

This technique can be useful when testing how a target or filtering device handles unusual TCP packets.

Like the Xmas scan, interpretation depends heavily on the target's TCP/IP implementation and network filtering.

FIN Scan

A FIN scan is performed with:

nmap -sF 192.168.1.1

Nmap sends a TCP packet containing only the:

FIN

flag.

Expected behavior:

Open port   → No response
Closed port → RST response

Example:

nmap -sF 192.168.1.10

FIN scanning provides another way to investigate TCP ports without using the standard SYN-based connection process.

Why Use These Scans?

FIN, NULL, and Xmas scans can be useful when analyzing:

  • Firewall behavior
  • IDS/IPS filtering
  • TCP/IP stack behavior
  • Network filtering rules
  • Non-standard responses from a target

Historically, these techniques could sometimes bypass basic packet-filtering rules because the packets did not resemble normal connection attempts.

However, they should not be considered automatically "undetectable."

Modern firewalls and IDS/IPS solutions can identify unusual TCP flag combinations, and network monitoring may detect these scans.

The Windows Limitation

One of the most important things to remember is that these scans depend on how the target operating system implements TCP behavior.

Systems such as Windows have historically not followed the expected RFC 793 behavior for these scans in the same way as many Unix/Linux systems.

As a result, FIN, NULL, and Xmas scans may produce less useful results against Windows targets.

This means the scan results should always be interpreted in context rather than blindly trusting the reported state.

Adding --reason

Nmap provides the --reason option to help understand why it classified a port in a particular way.

Example:

nmap -sX 192.168.1.10 --reason

Instead of only showing the state, Nmap provides information about the response that caused the classification.

This is particularly useful while learning because you can connect the result with the actual network behavior.

For example:

PORT     STATE         REASON
22/tcp   open|filtered no-response
80/tcp   closed        reset

Conceptually:

No response
     |
     +----> Could be an open port
     |
     +----> Could be filtered
RST response
     |
     +----> Closed port

The --reason option therefore helps during troubleshooting and analysis rather than simply giving you a final result.

Comparing the Three Scans

ScanNmap OptionTCP FlagsFIN-sFFINNULL-sNNoneXmas-sXFIN + PSH + URG

The general expected behavior is:

Target ResponseInterpretationRSTClosedNo responseOpen or filtered

This is why these scans commonly produce the state:

open|filtered

when Nmap cannot distinguish between an open port and a filtered port.

A Simple Lab Workflow

When testing these techniques in an authorized lab environment, I would approach them like this:

nmap -sF 192.168.1.10

Then:

nmap -sN 192.168.1.10

Then:

nmap -sX 192.168.1.10

Finally, use:

nmap -sX 192.168.1.10 --reason

Compare the results and focus on the differences in responses.

This makes the exercise more valuable than simply memorizing Nmap options.

Key Takeaways

FIN, NULL, and Xmas scans demonstrate an important concept in network reconnaissance: the way a system responds to an unusual packet can reveal information about its TCP implementation and filtering behavior.

The main points I learned:

  • -sF performs a FIN scan.
  • -sN performs a NULL scan.
  • -sX performs an Xmas scan.
  • These scans manipulate TCP flags instead of performing a standard SYN connection.
  • Closed ports are expected to respond with RST packets.
  • Open ports may remain silent.
  • No response can also indicate filtering.
  • Windows systems may produce different results because of their TCP implementation.
  • --reason helps understand why Nmap classified a port in a particular way.
  • These techniques are not guaranteed to bypass modern firewalls or IDS/IPS.

Understanding these scans is useful because effective reconnaissance is not just about knowing Nmap commands. It is about understanding why a scan produces a particular result and what that result actually means.

This was Part 7 of my Nmap Learning Series. In the next part, I'll continue exploring Nmap scanning techniques and how to interpret reconnaissance results more effectively.

#CyberSecurity #Nmap #NetworkSecurity #PenetrationTesting #EthicalHacking #Reconnaissance #InfoSec #CyberSecurityLearning #Linux #RedTeam