NMAP Firewall Scan

“When the attacker fails to enumerate open ports using a standard TCP scan due to aggressive firewalls rejecting SYN packets, advanced scanning methods utilizing fragmented and malformed packet structures are required.”

An -sS scan that comes back with every port filtered means one of two things: the host is genuinely locked down, or your packets never reached it in a form it was willing to answer. Novices read the first. NMAP Firewall Scan is about the second — manipulating the packet itself to find out which one you are actually looking at.

The Defensive Mindset

The manual’s structure is its best feature: it builds the firewall before it attacks it. You configure iptables rules yourself and watch your own scans fail against them.

Rules like iptables -I INPUT -p tcp --tcp-flags ALL SYN -j REJECT set up a hurdle whose behaviour you already understand, so the failed scan becomes diagnostic rather than mysterious. That distinction is worth internalising early: REJECT sends an ICMP unreachable and Nmap reports the port as filtered with a reason, while DROP sends nothing and the difference shows up in your Wireshark capture as silence versus an explicit refusal. Reading TTL values and packet lengths against that baseline is how you tell a firewall’s response from an endpoint’s.

Advanced Evasion Architectures

With the defences dropping standard traffic, the guide works through the evasion catalogue:

• Packet fragmentation: -f splits the TCP header across several tiny IP fragments so a stateless filter inspecting only the first one never sees the flags it was told to match on. The technique’s ceiling is worth naming — any firewall that reassembles fragments before inspection, which is every modern stateful appliance, is entirely unaffected. This works on old kit and on badly configured middleboxes.
• Malformed flags (FIN, NULL, XMAS): -sF, -sN and -sX sidestep a rule matching on SYN by never setting SYN. They rely on RFC 793 behaviour — a closed port must reply RST, an open port must stay silent — which means Windows has never been vulnerable to them, since it replies RST regardless and every port reads as closed. Against BSD-derived and older Unix stacks they still work, and the silent-means-open logic makes “open” and “filtered” indistinguishable, so the results are genuinely ambiguous rather than merely uncertain.
• Decoys and MAC spoofing: When you cannot get through, hide in the crowd. -D mixes your real source address among forged ones so the defender’s log shows twenty scanners and no obvious originator; spoofing the MAC of a trusted internal gateway can walk past a switch ACL. The cost of decoys is that they multiply the traffic you generate by the number of decoys, so an operator trying to stay quiet has just become the loudest thing on the segment.

Who Is This Book REALLY For?

• Red team edge breakers: When the perimeter is locked down and the default toolchain returns nothing useful, packet-level manipulation is what remains. Expect it to yield less against current appliances than the technique’s reputation suggests, and to be exactly right against the forgotten branch office router.
• Network defenders and firewall engineers: The clearest argument for why dropping SYN packets is not a strategy, and why fragment reassembly and strict protocol validation have to happen before the rule match rather than after.
• NOC analysts: Wireshark captures of what a fragmented -sF scan actually looks like on the wire, which is the raw material for a correlation rule that fires on something real instead of on port count.

The Bottom Line

NMAP Firewall Scan turns a discovery tool into an instrument for interrogating a boundary. Its more durable lesson is the one about interpretation: “filtered” is a statement about your packet’s journey, not about the target, and treating the two as the same thing is how perimeters get called secure.