TCP Connect scanning is a fundamental port scanning technique that completes the full TCP three-way handshake to determine if a port is open on a target system.
How TCP Connect Scanning Works?
In TCP Connect scanning, the scanning tool (such as Nmap) initiates a full connection to each target port by performing the standard TCP three-way handshake:
-
SYN: The scanner sends a SYN (synchronize) packet to the target port.
-
SYN-ACK: If the port is open, the target responds with a SYN-ACK (synchronize-acknowledge) packet.
-
ACK: The scanner completes the handshake by sending an ACK (acknowledge) packet.
After establishing the connection, the scanner immediately closes it, typically by sending a RST (reset) packet. This process allows the scanner to determine the status of each port:
-
Open: Full handshake completed.
-
Closed: Received a RST in response to the initial SYN.
-
Filtered: No response received, possibly due to a firewall.
When Is TCP Connect Scanning Used?
TCP Connect scanning is particularly useful in the following scenarios:
-
Lack of Raw Packet Privileges: On systems where the user does not have the necessary permissions to send raw packets (required for more stealthy scans like SYN scans), TCP Connect is the default method.
-
Scanning IPv6 Networks: Some scanning techniques are not compatible with IPv6. TCP Connect scanning, which relies on the operating system's networking stack, works seamlessly with IPv6.
-
Firewall and IDS Testing: Since TCP Connect scanning establishes full connections, it is more likely to be logged by firewalls and intrusion detection systems (IDS). This makes it useful for testing how these security systems respond to connection attempts.
-
Simplicity and Reliability: TCP Connect scanning is straightforward to implement and does not require special privileges, making it a reliable choice for quick assessments.
Limitations
While TCP Connect scanning is reliable, it has some drawbacks:
-
Easily Detectable: Because it completes full connections, it is more likely to be detected and logged by target systems.
-
Slower Performance: Establishing and closing full connections for each port can be time-consuming, especially when scanning a large number of ports or hosts.
Example Use Case
A system administrator wants to verify which services are running on a server but does not have administrative privileges on their scanning machine. They can use TCP Connect scanning with Nmap as follows:
nmap -sT 192.168.1.100
This command will perform a TCP Connect scan on the target IP address, identifying open ports by completing the TCP handshake for each.
