Which tool commonly performs SYN scans?

• A. Wireshark
• B. tcpdump
• C. Ping
• D. Nmap

Answer: (D)

SYN scanning probes which TCP ports are open by sending just the initial SYN packet and watching how the host responds. If a port is open, the target typically replies with SYN-ACK, and if closed it may reply with RST; if filtered by a firewall, there may be no reply. This lets you determine port status without completing a full TCP handshake, making the scan faster and less conspicuous.

Nmap is the tool that commonly performs this type of scan. It is built to send SYN packets, interpret the responses, and report which ports are open, closed, or filtered. The other options don’t fit because Wireshark and tcpdump are packet capture tools used to observe traffic rather than generate scans, and Ping uses ICMP to check reachability, not to assess TCP port status.