Connect Scans vs Stealth Ideas

TCP does not start as a stream of your HTTP. It starts as a negotiation. Host A wants to talk to a port on Host B. A sends SYN (“I want to start”). If something is listening and willing, B sends SYN-ACK (“I heard you, here is my half”). A sends ACK (“agreed”), and the connection is established. After that, bytes can flow — banners, HTTP, SSH greetings — which is Module 4’s problem, not this one. A connect scan, in Cyberlium wording, is: attempt that full negotiation, notice whether it finished, tear the socket down, try the next port on the SAME allowed host. It is honest. It is also loud in places that log accepted connections: SSH auth logs may stay quiet if you never speak SSH, but a local netstat, a firewall “established” counter, and some application servers will still have seen a client appear and leave.

On http://192.168.0.1/ the “other host” is YOUR lab app only after you identify it is not a router. Completing a handshake with python -m http.server you started is you talking to yourself (SAFE bind 127.0.0.1). Completing a handshake with a café POS is someone else’s door. Do not compare connect versus SYN on a school jumphost. Copy the command guide below, run it, then keep reading.

sudo apt install nmap
sudo apt install python3

brew install nmap
brew install python3

choco install nmap  # or download https://nmap.org/download.html

The half-open idea is simple enough to hold without a tool recipe. If a tester sends SYN and then does not complete ACK, the listener may have spent a moment in a half-open state (historically a SYN-flood resource issue as well — you will not practice floods). From a scanner’s selfish view, SYN-ACK still said “something is willing,” and RST said “nothing wants this,” while a silent drop said “filtered or dead.” From a defender’s view, systems that only log completed sessions can miss that knock. Packet capture, stateful firewalls, and IDS that watch handshake abuse may still see it. That split — session logs versus raw TCP — is why the nickname “stealth” exists. The nickname is a warning to defenders, not a grade for students.

This course will not tell you which nmap switch starts a SYN scan. It will not tell you how to fragment packets, decoy, idle-scan, or tune timing to slip past a SOC. Copy the literacy block below — definitions, not a hiding kit. connect_ex on YOUR lab already teaches OPEN versus not.

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

cat >> "$NOTES" << 'EOF'
connect_means: completed SYN + SYN-ACK + ACK (full handshake)
syn_half_open_means: SYN without the last ACK — a PICTURE for defenders, not homework
why_stealth_nickname: some APP/session logs only record completed sessions
defender_watch: firewall SYN counters / packet capture on systems YOU own
demo_url: http://192.168.0.1/  (STOP if router admin)
safe_host: 127.0.0.1
refuse: nmap -sS, timing templates, decoys, cafe, campus IDS hide
EOF

If you administer a box you own, prefer to look at more than one kind of record. A web server access log often shows completed HTTP, not a naked SYN. sshd may log a connection only after protocol greeting. A host firewall might count SYNs separately from ESTABLISHED. That is why a defender who only tails application logs can believe “nobody scanned us” while a packet capture shows a burst of SYNs. Teaching you that gap is ethical: it makes your future detection better. Teaching you how to aim the burst at a campus IDS is not ethical in this course. When you write notes, write the detection sentence: “connect scans are more visible in completed-session logs; half-open ideas exist so I do not trust those logs alone on systems I own.”

Do not invert the lesson into “therefore I should always half-open so I am invisible.” On a café, quiet unauthorized scanning is still unauthorized. Stay honest on YOUR lab (DEMO http://192.168.0.1/ if it is your app; else 127.0.0.1). Copy the local-listener check below.

sudo apt install curl

ss -ltn || netstat -ltn

curl -sS -m 2 -D - "http://127.0.0.1:8000/" | head -n 12

Refusal list, write it into the notes: no nmap timing templates as an evasion drill; no guest VLAN; no decoys; no idle scan of a neighbor; no “use SYN so the café does not log me.” Positive list: define connect vs half-open; run the command guides on YOUR lab (http://192.168.0.1/ if it is your app, else 127.0.0.1); chmod 600.

If a video titled with a cert acronym demonstrates those refusals against a public IP, that video is not this lesson. Original Cyberlium teaching mapped to a CEH v13 domain does not import the demo’s target. Completing this file does not grant CEH. If you feel behind because you did not hide from anyone, you are on the path. Lesson 3 will make the output words precise — OPEN, closed_or_filtered, timeout — still about a listener you started or the absence of one on loopback.

The required artifact is a notes file, not a stealth tool. Fill definitions, the defender sentence, the ethics line, and the legal line. The Python below is optional proof you can still complete a handshake on loopback; it refuses any other host and does not implement half-open packets. Windows: WSL/Git Bash for chmod, or restrict the file in your profile; Test-NetConnection 127.0.0.1 -Port 8000 is still a connect-style check, still loopback only.

sudo apt install nmap
sudo apt install python3

brew install nmap
brew install python3

choco install nmap  # or download https://nmap.org/download.html

cd "$HOME/cyberlium-lab"

cat > connect_vs_stealth_check.py << 'PY'
import socket

HOST = "127.0.0.1"
PORT = 8000
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback — this is not a stealth scanner")

s = socket.socket()
s.settimeout(1.0)
s.close()
print("host:", HOST)
print("port:", PORT)
print("meaning: 0 => completed TCP handshake from this process")
print("stealth_idea: SYN without final ACK may miss session logs — defenders watch more than apps")
print("ethics: 127.0.0.1 only; no cafe; no campus; no IDS evasion cookbook")
PY

python3 connect_vs_stealth_check.py || python connect_vs_stealth_check.py

{

You now can say connect versus SYN without turning either word into a café playbook. A completed handshake is a real session from the stack’s view and is easier to see in many logs. A half-open idea exists so defenders do not trust those logs alone. Students still only scan 127.0.0.1. Notes are locked. This is original Cyberlium teaching mapped to a CEH v13 domain — not official EC-Council training, not a cert, not exam dumps. Next — Reading Scan Output Without Crossing Scope — treats OPEN, closed_or_filtered, and timeout as facts about YOUR listener, not as permission to hunt the LAN until something answers.