CAPEC-299: TCP SYN Ping
Description
An adversary uses TCP SYN packets as a means towards host discovery. Typical RFC 793 behavior specifies that when a TCP port is open, a host must respond to an incoming SYN synchronize packet by completing stage two of the 'three-way handshake' - by sending an SYN/ACK in response. When a port is closed, RFC 793 behavior is to respond with a RST reset packet. This behavior can be used to 'ping' a target to see if it is alive by sending a TCP SYN packet to a port and then looking for a RST or an ACK packet in response.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Low
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The ability to send a TCP SYN packet to a remote target. Depending upon the operating system, the ability to craft SYN packets may require elevated privileges.
Skills required
- LowThe adversary needs to know how to craft and send protocol commands from the command line or within a tool.
Consequences
- Confidentiality
Other
- ConfidentialityAccess ControlAuthorization
Bypass Protection Mechanism; Hide Activities
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.