What is tcb scans?

TCB (Transmission Control Block) scan is a type of network scanning method that is used by attackers to identify open and vulnerable ports on a target system.

In TCB scan, the attacker crafts a TCP connection request with a random destination IP address and port number and sends it to the target system. If the target system responds with a TCP Reset packet (indicating that the port is closed) or an ICMP Error packet (indicating that the port is filtered), then the attacker knows that the port is not vulnerable. However, if the target system does not respond at all, then the attacker can assume that the port is open.

TCB scan is a stealthy scanning method because it does not establish a full TCP connection, which could alert the target system's intrusion detection systems. This type of scanning is often used in combination with other scanning methods to gather more information about the target system.

To prevent TCB scans, network administrators can implement firewall rules to filter out incoming packets with invalid destination IP addresses or invalid port numbers. They can also use intrusion detection and prevention systems to detect and block TCB scan attempts.