Scan Types :
| Flag | Description | Use cases | Firewall & EDS detection (2026) |
|---|---|---|---|
-sS | TCP SYN scan | Standard full recon (with root) | Yes |
-sT | TCP Connect Scan | Non-root or routing over SOCKS/Tor | Yes |
-sU | UDP scan | Service audit for DNS, SNMP, NTP | Yes |
-sA | Acknowledge Scan | Mapping firewall / ACL rules | Yes |
-sW | Window Scan | Differentiating open/closed ports on specific legacy/non-RFC TCP stacks behind stateless filters | Yes |
-sM | Maimon scan | Evading older BSD-derived packet filters; legacy host fingerprinting | Yes |
-sN | TCP Null scan | Bypassing simple stateless filters | Yes |
-sF | TCP Fin scan | Bypassing simple stateless filters | Yes |
-sX | TCP X-mas scan | Bypassing simple stateless filters | Yes |
-sI | Zombie scan | Completely anonymous / spoofed target mapping | Low on Scanner / Yes on Zombie |
-sY | SCTP INIT scan | Telecom / Core Mobile Networks | often bypasses basic enterprise L4 firewalls unaware of SCTP |
-sZ | COOKIE-ECHO scan | Telecom / Core Mobile Networks | Bypasses naive SCTP filters but flagged by deep packet inspection engines inspecting chunk states |
-sO | IP protocol scan | Determining supported L3 protocols | YES |
-b | FTP bounce scan | Bypassing internal network segmentation via proxy host | Partial on Scanner / High on FTP (Obsolete/blocked on modern FTP daemons; logged immediately on the FTP proxy) |
Custom Scan
Use
--scanflagsoption to set TCP packet flags manually