This activity clearly indicates a TCP SYN scan, also known as a half-open scan, which is a commonly used stealth scanning technique discussed in CEH v13 Reconnaissance and Network Scanning. In a SYN scan, the attacker sends TCP SYN packets to target ports and observes the responses without completing the TCP three-way handshake.
If the port is open, the target responds with a SYN/ACK packet. The scanner then immediately sends a RST packet instead of the final ACK, leaving the connection half-open. This behavior allows attackers to identify open ports while minimizing log entries and reducing detection by security monitoring tools.
The absence of ACK packets in logs supports this explanation, as the handshake is never completed.
Other options are incorrect because:
XMAS scans send packets with multiple flags set.
SYN/ACK scans are primarily used for firewall rule discovery.
TCP Connect scans complete the full handshake and generate ACKs.
CEH v13 emphasizes that SYN scans are widely used because they balance accuracy and stealth, making them a preferred reconnaissance method for attackers.
