Detect TCP window scans by comparing ACK responses that reveal different TCP window sizes or related behaviour from closed ports. These probes rely on subtle response differences rather than a full handshake. Because they are highly specific, the clearest signal is repeated suspicious ACK traffic with no legitimate application context and consistent destination sweeping.
What makes TCP window scans different from ordinary port probes?
tcp window scan are subtle reconnaissance probes, not full connection attempts. The scanner relies on how some closed ports answer an ACK segment and tries to infer state from the reported window size or closely related response behaviour. That makes the technique quieter than a normal handshake-driven scan, but also narrower: you are looking for a specific pattern of ACK traffic against destinations that should not be answering that way.
In practice, the question is not whether a single ACK packet exists, it is whether the traffic pattern matches a reconnaissance sweep. Repeated probes across many destinations, especially where there is no legitimate session context, matter more than any one reply. The best detections therefore combine packet-level response analysis with destination-wide correlation, rather than treating each packet in isolation.
How do teams distinguish a scan from harmless ACK noise?
The key discriminator is consistency. A benign ACK seen in isolation may come from retransmission, middlebox behaviour, or an application recovering from loss. A window scan tends to produce a steady series of suspicious ACKs that sweep destination ranges while eliciting repeatable closed-port responses. That pattern is far more important than a single anomalous window value.
Good detection logic should also account for context. If the traffic source is not expected to maintain sessions with the targets, and the ACKs arrive without a preceding, legitimate three-way handshake, the signal is stronger. Correlate the source, destination spread, timing, and TCP flags together so you are not overcalling normal retry behaviour as reconnaissance.
For teams building network visibility, Network Ports and Protocols Security Guide is a useful reference point for understanding why closed-port response differences matter and how exposed services create scanning opportunities.
How should detection be tuned in a SOC or NDR stack?
Tune for low-volume, high-specificity events rather than raw packet counts. Window scans can be easy to miss if you only alert on flood-like behaviour. Practical detections usually combine ACK-only probes, no session establishment, repeated destination sweeping, and closed-port response traits that differ from normal traffic baselines. If your tooling can enrich with service inventory, you can suppress scans aimed at approved management or monitoring paths and raise confidence on everything else.
Window scans are also easier to spot when you compare them with the expected role of the target network. On a server segment that should mainly accept known application flows, unexplained ACK traffic has much less legitimate explanation than on a noisy user segment. That is why asset context, segmentation knowledge, and protocol normalisation are as important as the packet signature itself.
Risk and Threat Considerations
Window scans are a reconnaissance technique, so the risk is less about immediate compromise and more about exposure mapping. They can help an attacker identify live hosts, filter responsive networks, and refine follow-on exploitation paths without generating the obvious patterns of a full connect scan.
Failure mechanism: Detection fails when teams rely on handshake-based signatures, ignore ACK-only probes, or do not correlate repeatable window-size behaviour across multiple destinations. Low-and-slow sweeping can blend into background noise if closed-port responses are not baselined.
Impact: Missed reconnaissance gives an attacker cleaner target selection and better timing for later exploitation. It can also hide early-stage mapping activity that should have triggered containment, especially on exposed edge systems and segmented internal ranges.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1595 — Active Scanning | TCP window scans are a form of active reconnaissance against exposed hosts. |
| T1046 — Network Service Discovery | The technique is used to discover live services and host response behaviour. | |
| Recommendation — Map repeated ACK-based probing to active scanning and alert on destination sweeping. Correlate ACK-only probes with service discovery activity across target ranges. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to detect potentially adverse events | Detection depends on monitoring network traffic patterns and suspicious protocol behaviour. |
| Recommendation — Monitor ACK-only traffic patterns and closed-port response anomalies for scanning. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | This is a network reconnaissance pattern best handled through monitoring and detection controls. |
| Recommendation — Tune network monitoring to flag repeated ACK probes and destination sweeps. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | The subject is a detectable network activity pattern requiring monitoring and alerting. |
| Recommendation — Configure monitoring to detect suspicious ACK traffic and repeated probing patterns. | ||
Practitioner Guidance
What to verify: Confirm whether the source has any legitimate reason to send ACKs to the destination set, then check whether the same pattern repeats across multiple closed ports with no successful session establishment. If the answer is yes, treat it as reconnaissance until proven otherwise.
What to measure: Track the ratio of ACK-only probes to completed connections, the breadth of destination sweeping, and whether the window-size behaviour is consistent across repeated attempts. Those three signals are usually more useful than a single packet signature.
Common mistake: Writing the rule too narrowly around one packet shape. Window scans are defined by the behavioural pattern, so a detector that only keys on one response detail will miss variants or fire on harmless retransmissions.
Practitioner takeaway: The most reliable detections combine packet semantics with sweep behaviour and asset context, because a TCP window scan is valuable to an attacker precisely when it looks like low-noise reconnaissance instead of an obvious scan.