XMAS Tree Port Scan

XMAS Packet has all the flags checked or on.This is opposite to a NULL packet.his is called a XMAS tree scan because of the alternating bits turned on and off in the flags byte (00101001), much like the lights of a Christmas tree.

Attacker => XMAS => Target

case1 : port open
  Target => RST =>Attacker
case2: port closed
 No Response or Error

XMAS Scan using Nmap :

nmap -sX -v www.target.com