I'm having trouble figuring this out. Supposedly, nmap
can distinguish stateful firewalls from stateless firewalls by using the -sA
or ACK scan, but I'm at a loss as to how one would discern that fact from the nmap
output of an ACK scan.
I understand that nmap
sends ACK flagged packets to the target and the target will respond or not respond based off certain criteria.
- Target will respond with RST if port is open or closed and unfiltered.
- Target will NOT respond at all if filter is DROPPING traffic
- Target will send ICMP error message if filter is REJECTING traffic
That being true, then ´nmap´ will report any port that responds with RST as unfiltered and all the other ports as filtered. This looks something like this... (using IPTABLES
firewall with stateless rule(s))
$ sudo nmap -sA -T4 192.168.219.135
Starting Nmap 7.12 ( https://nmap.org ) at 2016-06-28 16:35 EDT
Nmap scan report for metasploitable (192.168.219.135)
Host is up (0.00027s latency).
Not shown: 994 filtered ports
PORT STATE SERVICE
22/tcp unfiltered ssh
25/tcp unfiltered smtp
53/tcp unfiltered domain
70/tcp unfiltered gopher
80/tcp unfiltered http
113/tcp unfiltered ident
MAC Address: 00:0C:29:B7:F7:70 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 4.40 seconds
Based off of that output, how would one discern whether this was stateful or stateless?
I've been reading everything I can on the subject, including the nmap
book, and none of the examples makes sense to me. This is basically the same output as example 10.2 in the nmap
book; in fact it is almost identical! The problem is that the nmap
book states that this is the output from nmap
that targeted a host running IPTABLES
with STATEFUL rules!
If I can get the same output from a stateless firewall as I can from a stateful firewall, then how am I supposed to tell from the nmap
ACK scan which firewall I'm encountering?
I'm super frustrated and I really appreciate any help sent my way.