In reply to Sascha Lucky Luck's flatulent wordings,
> Thus spoke Smelly Pooh:
> >
> > I suspect they would, but that's a configuration issue, firewalls if they're
> > blocking/dropping TCP connections look for the initial SYN, not the ACK to the
> > SYN ACK.
>> If the fw is denying any inbound TCP connection to a certain port, it'll look
> at the dst socket and drop/reject. If it's configured to permit inbound
> established, it'll look for an ACK.
No, if the firewall is looking for an inbound TCP connection it'll look for
an incoming SYN (but not a SYN ACK) on that port, otherwise an outgoing
connection from the same port will also be dropped, as will any established
connection using that port (if it makes it that far)
But basically the half-connect "stealth" scan in question shouldn't work on
most packet filtering firewalls, but should work on proxy firewalls or the
likes of TCPWrappers.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
