NULL SCAN

The NULL scan unsets ALL flags available in the TCP header. ACK, FIN, RST, SYN, URG, PSH all become unassigned.

If the port OPEN.
client -> NULL (no flags)
server -> -

Alternatively, an RST packet will be returned if a CLOSED port has been reached
client -> NULL (no flags)
server -> RST