[ILUG] port scanning.. continued.

[Smelly Pooh]

In reply to Sascha Lucky Luck's flatulent wordings, 
> Thus spoke Smelly Pooh:
> > 
> > I suspect they would, but that's a configuration issue, firewalls if they're
> > blocking/dropping TCP connections look for the initial SYN, not the ACK to the
> > SYN ACK.
> 
> If the fw is denying any inbound TCP connection to a certain port, it'll look
> at the dst socket and drop/reject. If it's configured to permit inbound 
> established, it'll look for an ACK.

No, if the firewall is looking for an inbound TCP connection it'll look for
an incoming SYN (but not a SYN ACK) on that port, otherwise an outgoing
connection from the same port will also be dropped, as will any established
connection using that port (if it makes it that far)

But basically the half-connect "stealth" scan in question shouldn't work on
most packet filtering firewalls, but should work on proxy firewalls or the
likes of TCPWrappers.