Understanding Christmas Tree (XMAS) Scans: TCP Reconnaissance and Network Defense

 XMAS Tree Scan

A Christmas Tree Scan is a type of TCP reconnaissance scan used by attackers or penetration testers to gather information about open ports and operating systems on a target machine. It’s named for the same reason as the Christmas Tree Attack, because the TCP packet has all the flags turned on, like ornaments on a tree.

What Is a Christmas Tree Scan?

In a Christmas Tree Scan, the attacker sends TCP packets with the following flags set:

• URG (Urgent)
• PSH (Push)
• FIN (Finish)

These flags are not typically used together in everyday TCP communication. Their unusual combination can trigger different responses from different operating systems, which helps the attacker identify:

• Open or closed ports
• Firewall behavior
• Operating system fingerprinting

How It Works

1. Crafting the Packet: The attacker uses a tool (like Nmap) to send TCP packets with URG, PSH, and FIN flags set.

2. Sending to Target Ports: These packets are sent to a range of ports on the target system.

3. Analyzing Responses:

• No response: Indicates the port is open.
• RST (Reset) response: Indicates the port is closed.
• ICMP unreachable: May indicate a filtered port (blocked by a firewall).

4. Fingerprinting OS: Different operating systems respond differently to these packets, allowing the attacker to guess the OS type.

Tools Used

Nmap: A Popular tool for conducting Christmas Tree Scans.

 

The -sX option tells Nmap to perform a Christmas Tree Scan.

Limitations

Noisy: Easily detected by intrusion detection systems (IDS).

Not stealthy: Most modern firewalls and IDS/IPS are configured to recognize and block these scans.

Only works on systems that respond to abnormal packets; some hardened systems ignore them entirely.

Defense Against Christmas Tree Scans

• Use stateful firewalls that drop packets with unusual flag combinations.
• Deploy intrusion detection systems that log and alert on scan activity.
• Harden network devices to ignore malformed or suspicious packets.
• Rate-limit and monitor traffic to detect scanning behavior.