{
  "node_id": "mitre-capec-capec-305-tcp-ack-scan",
  "title": "MITRE CAPEC-305: TCP ACK Scan (Detailed Attack Pattern - Low Severity)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-05-25",
  "bluf": "MITRE CAPEC-305 (TCP ACK Scan) is a detailed-level attack pattern in the MITRE Common Attack Pattern Enumeration and Classification. An adversary uses TCP ACK segments to gather information about firewall or ACL configuration. The purpose of this type of scan is to discover information about filter configurations rather than port state. This type of scanning is rarely useful alone, but when combined with SYN scanning, gives a more complete picture of the type of firewall rules that are present. Likelihood of attack: Unknown. Typical severity: Low. Maps to weaknesses CWE-200.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "mitre_attack"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-sp-800-53-r5",
    "iso-27001-2022",
    "cis-controls-v8",
    "owasp-asvs-l2"
  ],
  "primary_citations_count": 7
}