Which hping3 command performs an ACK scan on port 80?

• A. hping3 -1 10.0.0.25
• B. hping3 -A 10.0.0.25 -p 80
• C. hping3 -2 10.0.0.25 -p 80
• D. hping3 -S 72.14.207.99 -p 80 --tcp-timestamp

Answer: (B)

An ACK scan is done by sending TCP segments that have the ACK flag set, without trying to complete a full TCP handshake. In hping3, the -A option activates the ACK flag in the TCP header. So, the command hping3 -A 10.0.0.25 -p 80 sends an ACK packet to port 80 on that host. This kind of scan helps you infer firewall rules: if you receive a RST, the port is considered unfiltered; if you get no response, the port is likely filtered by a firewall or IDS. The other options aren’t ACK scans because they use different protocols or TCP flags (one uses ICMP, another uses UDP, and another uses a SYN with a timestamp, which is a SYN scan).