How does a TCP Xmas Scan attack work?

It typically unfolds over 2 phases. It begins with: An adversary sends TCP packets with all flags set but not associated with an existing connection to target ports.

How do you prevent CAPEC-303?

Employ a robust network defensive posture that includes a managed IDS/IPS.

What weaknesses does CAPEC-303 target?

CAPEC-303 exploits 1 CWE weakness, including CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How severe is CAPEC-303?

MITRE rates CAPEC-303 as Low severity.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Detailed attack pattern

Stable

CAPEC-303: TCP Xmas Scan

An adversary uses a TCP XMAS scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with all possible flags set in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.

Last updated June 1, 2026

Low

Typical severity

Per MITRE

Not rated

Likelihood of attack

Per MITRE

1

Related weaknesses

CWEs this targets

Detailed

Abstraction

MITRE classification

Overview

In addition to its relative speed when compared with other types of scans, its major advantage is its ability to scan through stateless firewall or ACL filters. Such filters are configured to block access to ports usually by preventing SYN packets, thus stopping any attempt to 'build' a connection. XMAS packets, like out-of-state FIN or ACK packets, tend to pass through such devices undetected. Because open ports are inferred via no responses being generated, one cannot distinguish an open port from a filtered port without further analysis. For instance, XMAS scanning a system protected by a stateful firewall may indicate all ports being open. Because of their obvious rule-breaking nature, XMAS scans are flagged by almost all intrusion prevention or intrusion detection systems.

How the attack works

The phases an attacker typically follows to carry out this attack.

Step 1
Experiment
An adversary sends TCP packets with all flags set but not associated with an existing connection to target ports.
Step 2
Experiment
An adversary uses the response from the target to determine the port's state. If no response is received the port is open. If a RST packet is received then the port is closed.

What the attacker needs

Prerequisites

The adversary needs logical access to the target network. XMAS scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix and Linux, raw socket manipulations require root privileges.

Resources required

This attack can be carried out with a network mapper or scanner, or via raw socket programming in a scripting language. Packet injection tools are also useful for this purpose. Depending upon the method used it may be necessary to sniff the network in order to see the response.

Consequences

What a successful CAPEC-303 attack can achieve.

Other

Affects: Confidentiality

Bypass Protection Mechanism, Hide Activities

Affects: Confidentiality, Access Control, Authorization

Unreliable Execution

Affects: Availability

How to mitigate it

Defenses that reduce the risk of CAPEC-303.

Employ a robust network defensive posture that includes a managed IDS/IPS.

Frequently asked questions

Common questions about CAPEC-303.

What is CAPEC-303?: An adversary uses a TCP XMAS scan to determine if ports are closed on the target machine. This scan type is accomplished by sending TCP segments with all possible flags set in the packet header, generating packets that are illegal based on RFC 793. The RFC 793 expected behavior is that any TCP segment with an out-of-state Flag sent to an open port is discarded, whereas segments with out-of-state flags sent to closed ports should be handled with a RST in response. This behavior should allow an attacker to scan for closed ports by sending certain types of rule-breaking packets (out of sync or disallowed by the TCB) and detect closed ports via RST packets.
How does a TCP Xmas Scan attack work?: It typically unfolds over 2 phases. It begins with: An adversary sends TCP packets with all flags set but not associated with an existing connection to target ports.
How do you prevent CAPEC-303?: Employ a robust network defensive posture that includes a managed IDS/IPS.
What weaknesses does CAPEC-303 target?: CAPEC-303 exploits 1 CWE weakness, including CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
How severe is CAPEC-303?: MITRE rates CAPEC-303 as Low severity.

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.

Defend against CAPEC-303

Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.

Start free See pricing