Nmap Countermeasures

• If the Linux host accepts inbound echo-request packets, nmap can fingerprint it

  • Tried blocking outbound echo-reply, port-unreachable, destination-unreachable, etc., and finally all ICMP... no joy

• If it drops inbound echo-requests in conjunction with the test conditions mentioned previously... still no joy

• If we reject rather than drop packets... no joy here either

• We have to block standard nmap port scanning to prevent fingerprinting