An attacker uses a SYN scan to determine the status of ports on the remote
						target. SYN scanning is the most common type of port scanning that is used
						because of its enormous advantages and few drawbacks. As a result, novice
						attackers tend to overly rely on the SYN scan while performing system
						reconnaissance. As a scanning method the primary advantages of SYN scanning
						are its universality and speed. RFC 793 defines the required behavior of any
						TCP/IP device in that an incoming connection request begins with a SYN
						packet, which in turn must be followed by a SYN/ACK packet from the
						receiving service. For this reason, like TCP Connect scanning, SYN scanning
						works against any TCP stack. Unlike TCP Connect scanning, it is possible to
						scan thousands of ports per second using this method. This type of scanning
						is usually referred to as 'half-open' scanning because it does not complete
						the three-way handshake. The scanning rate is extremely fast because no time
						is wasted completing the handshake or tearing down the connection. TCP SYN
						scanning can also immediately detect 3 of the 4 important types of port
						status: open, closed, and filtered. When a SYN is sent to an open port and
						unfiltered port, a SYN/ACK will be generated. This technique allows an
						attacker to scan through stateful firewalls due to the common configuration
						that TCP SYN segments for a new connection will be allowed for almost any
						port. When a SYN packet is sent to a closed port a RST is generated,
						indicating the port is closed. When SYN scanning to a particular port
						generates no response, or when the request triggers ICMP Type 3 unreachable
						errors, the port is filtered. A TCP Connect scan has the following
						characteristics:1. Speed: TCP SYN scanning is fast compared to other types of
							scans.2. Stealth: TCP SYN scanning is stealthy and SYN scan detection is
							fraught with false positives.3. Open Port: Detects that a port is open via a successful SYN/ACK to
							the SYN.4. Closed Port: Detects that a port is closed via a successful RST to
							the SYN5. Filtered Port: No response, or ICMP messages, indicates the
							presence of a filter.6. Unfiltered Port: Cannot distinguish between a state-fully filtered
							port and an unfiltered port.