Different Nmap Techniques

• Sends FIN

  • Target shouldn't respond, but some OSes send RST back (e.g., MS Windows, IRIX, HP-UX)

• Examines TCP ISN pattern

  • Traditional 64K (many old Unixes)
  • Random increment (Solaris, IRIX, FreeBSD)
  • True “random” (newer Linux and AIX)
  • Time-dependent (MS Windows)
  • Constant (some 3Com hubs, Apple LaserWriters)