During PCAP analysis, an analyst notices TCP sessions where the three-way handshake completes but no data is ever transferred before the connection is reset. Large numbers of these are observed across many destination ports. What does this indicate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because a TCP connect scan completes the full three-way handshake to confirm a port is open, then immediately sends a RST; seeing this across many ports is a definitive indicator of port scanning. A is wrong because UDP floods involve UDP packets, not TCP handshakes.
Full explanation below image
Full Explanation
B is correct because a TCP connect scan completes the full three-way handshake to confirm a port is open, then immediately sends a RST; seeing this across many ports is a definitive indicator of port scanning. A is wrong because UDP floods involve UDP packets, not TCP handshakes. C is wrong because load balancer health checks probe specific known service ports repeatedly, not many different ports. D is wrong because TLS failures occur after the handshake during the certificate exchange phase.