Question

During an internal engagement, you connect to a jump host where you only have a standard (non-root) user account. You attempt to run 'nmap -sS 10.10.5.0/24' to perform a SYN scan across the subnet, but Nmap warns it is falling back to a different scan type. Which explanation best describes what is happening and how to proceed effectively?

Accepted Answer

SYN scanning requires raw packet (root/CAP_NET_RAW) privileges; without them Nmap falls back to a TCP connect scan (-sT), which completes the full three-way handshake and is noisier but still valid

Answer

The subnet is being blocked by a firewall, so Nmap automatically switches to a UDP scan to bypass the filtering rules

Answer

SYN scans only work against Windows hosts, so Nmap detected Linux targets and downgraded to an ICMP-only ping sweep

Answer

Nmap requires the -Pn flag to run a SYN scan, and adding it will restore raw SYN scanning without elevated privileges