Nmap Scan Techniques - TCP ACK, Window
Right Nmap help again.
And then our scan techniques, we have the ACK scan, A C K scan.
This scan is different than the others discussed so far in that it never determines open or even open filtered ports.
It is used to map out firewall rules to determine whether they are stateful or not. And which ports filtered.
If we click over here.
This is the command simply -S -A the ACK scan pro packet has only the ACK flag set when scanning unfiltered systems open and close ports will both return a reset packet.
Nmap then labels them as own filtered, meaning that they are unreachable by the ACK packet, but whether they are open or closed is undetermined ports that don't respond or send certain ICMP error messages, bite, like type three, code 1, 2, 3, 9, 10, or 13, all labeled filtered.
If you have a device with a filtering firewall in front of it, try scaling it with this scan because it's used to map out firewall rules and determine whether they are stateful or not.
And which ports are filtered.
Then we have the windows scan, which is here.
And we can see an example of it here.
The window scan is exactly the same as the ACK scan, except that it exploits an implementation detail of certain systems to differentiate open ports from closed ones, rather than always printing on filtered.
When a reset is returned, it does this by examining the TCP window field or the reset packets returned.