Which port state means Nmap cannot determine whether a port is open or filtered, typically for UDP, IP protocol, FIN, NULL, and Xmas scans?

• A. unfiltered
• B. open|filtered
• C. filtered
• D. open

Answer: (B)

Port states in Nmap reflect how much the probe’s reply clarifies whether a port is open. When there’s no definitive reply that proves the port is open or proves it’s filtered, Nmap uses the state that signals ambiguity: the port could be open or could be blocked by a firewall, so it labels it open|filtered. This situation commonly occurs with UDP scans, IP protocol discovery, and TCP scans using FIN, NULL, or Xmas packets, because open ports often don’t produce a response to these probes and some firewalls drop or ignore them. If a clear indication of open or filtered isn’t obtained, open|filtered is the best representation of that uncertainty.