RE: Idle Scanning behind stateful firewalls

[<nmap () moiler com>]

Hi Paul,

Yep - but if the zombie and target are behind the stateful firewall, then
nmap's SYNs could get through to the target, the target's SYN/ACKs would hit
the zombie and nmap's SYN's would get through the stateful firewall where
SYN/ACKs wouldn't.  This one might need a picture!

Glyn Geoghegan.

> -----Original Message-----
> From: Paul Johnston [mailto:paul () westpoint ltd uk] 
> Sent: 26 March 2004 20:40
> To: Glyn Geoghegan
> Cc: nmap-dev () insecure org
> Subject: Re: Idle Scanning behind stateful firewalls
>
> Glyn,
>
> For idle scan to work, SYN ACK packets from the target host must get 
> through to the zombie. If these don't get through then the scan won't 
> work, regardless of what packets nmap uses to probe the ipid 
> on the zombie.
>
> Paul
>
> > But, because nmap uses a SYN/ACK, its probes get dropped by 
> any stateful
> > devices (coz they aren't part of an active connection), 
> preventing their use
> > as zombies.
> >  
> -- 
> Paul Johnston
> Internet Security Specialist
> Westpoint Limited
> Albion Wharf, 19 Albion Street,
> Manchester, M1 5LN
> England
> Tel: +44 (0)161 237 1028
> Fax: +44 (0)161 237 1031
> email: paul () westpoint ltd uk
> web: www.westpoint.ltd.uk


---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org