Re: Firewall Identification via nmap SYN, Stealth FIN, Xmas Tree, and Null scans

From: C Colon (foobar@asia.com)
Date: 06/05/02 

From: foobar@asia.com (C Colon)
Date: 4 Jun 2002 22:28:15 -0700

: In comp.security.misc omegatron <omegatron@hushmail.com> wrote:
: I am performing a penetration test for a client and I am trying to
: determine what type of firewall (which at this point is transparent
to
: me) is filtering traffic on the target network.

: Xmas Tree (-sX) and Null (-sN) scans against the same host lists all
: ports as OPEN. I haven't done a TCP Connect (-sT) scan yet, but
based
: on my other data using TCP Connect scans against the same network, I
: believe the ports will be in FILTERED state.
  
: Are these varying results indicative of any specific firewall
policies
: that may identify a particular firewall? Any help would be
: appreciated. Thanks...

Please ensure that by publishing scan results for public view, you are
not breaching any confidentiality agreements that you may have with
the client. I am not sure whether such a post would be in line with
what your client expects.

Regards
C:\>
-----------------------------------------------------
Kindly post replies to the newsgroups itself

Relevant Pages
Quantcast