L'un des avantages est qu'il n'est plus possible de faire des ACK Scan.
Exemple :
% sudo nmap -sA plop -v -F Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-05-09 21:01 CEST Initiating ACK Scan against plop (192.168.0.42) at 21:01 Interesting ports on plop (192.168.0.42): (The 1209 ports scanned but not shown below are in state: filtered) PORT STATE SERVICE 21/tcp UNfiltered ftp 22/tcp UNfiltered ssh 25/tcp UNfiltered smtp 80/tcp UNfiltered http 443/tcp UNfiltered https 993/tcp UNfiltered imaps Nmap run completed -- 1 IP address (1 host up) scanned in 54.642 seconds
Modifions désormais nos règles firewall sans la vilaine erreur :
% sudo nmap -sA plop -v -F Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-05-09 21:04 CEST Host plop (192.168.0.42) appears to be up ... good. Initiating ACK Scan against plop (192.168.0.42) at 21:04 All 1217 scanned ports on plop (192.168.0.42) are: filtered Nmap run completed -- 1 IP address (1 host up) scanned in 57.622 seconds
Adieu ACK Scan :)
Ça devrait être indiqué dans une FAQ ou le HOWTO !