How can fragment packets -f/--mtu be usefull ?

That is, say from a normal scan I get for a given IP and port range:

28/tcp filtered unknown   no-response
29/tcp filtered msg-icp   no-response
30/tcp filtered unknown   no-response
31/tcp filtered msg-auth  no-response

can this "no-response" from the above be something else if I use -f/--mtu

Note that I tried a few IPs but got the same result.

I'd read in https://nmap.org/book/man-bypass-firewalls-ids.html that is helps bypass IDS/firewall, but how can I exploit this to make it reveal something other than "no-response" ?


These options are much less likely to be useful these days since the bypass technique they use has been widely published, and pretty much all modern firewalls will either drop all fragmented packets or do packet reassembly on their own.

The way fragmentation is supposed to evade a firewall is by splitting the packet into such small pieces that the firewall cannot identify each one as using a port that should be rejected. This only works if the firewall also allows all unidentifiable traffic through (fail-open).

|improve this answer|||||
  • @user2901196 I've written about avoiding detection here. Any technique that evades a firewall is a flaw in the firewall, so there tend to not be many of those around. – bonsaiviking Apr 23 '19 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.