I'm having trouble figuring this out. Supposedly, nmap can distinguish stateful firewalls from stateless firewalls by using the -sA or ACK scan, but I'm at a loss as to how one would discern that fact from the nmap output of an ACK scan.
I understand that nmap sends ACK flagged packets to the target and the target will respond or not respond based off certain criteria.
- Target will respond with RST if port is open or closed and unfiltered.
- Target will NOT respond at all if filter is DROPPING traffic
- Target will send ICMP error message if filter is REJECTING traffic
That being true, then nmap will report any port that responds with RST as unfiltered and all the other ports as filtered. This looks something like this... (using IPTABLES firewall with stateless rule(s) )
$ sudo nmap -sA -T4 192.168.219.135 Starting Nmap 7.12 ( https://nmap.org ) at 2016-06-28 16:35 EDT Nmap scan report for metasploitable (192.168.219.135) Host is up (0.00027s latency). Not shown: 994 filtered ports PORT STATE SERVICE 22/tcp unfiltered ssh 25/tcp unfiltered smtp 53/tcp unfiltered domain 70/tcp unfiltered gopher 80/tcp unfiltered http 113/tcp unfiltered ident MAC Address: 00:0C:29:B7:F7:70 (VMware) Nmap done: 1 IP address (1 host up) scanned in 4.40 seconds
Based off of that output, how would one discern whether this was stateful or stateless?
I've been reading everything I can on the subject, including the nmap book, and none of the examples makes sense to me. This is basically the same output as example 10.2 in the nmap book; in fact it is almost identical! The problem is that the nmap book states that this is the output from nmap that targeted a host running IPTABLES with STATEFUL rules!
If I can get the same output from a stateless firewall as I can from a stateful firewall, then how am I supposed to tell from the nmap ACK scan which firewall I'm encountering?
I'm super frustrated and I really appreciate any help sent my way.