Using Decoys and Packet Fragmentation in nmap to Bypass Firewalls

How to know if a device has firewall:-

nmap tells us the port is filtered if the port hides behind a firewall or ids

nmap -f is used to fragment packets.

TCP header is split into parts so that the firewall has hard time reading content

you can specify -f multiple times to split a packet again and again.

-f once will give 8 byte packet

-f -f will give 16 byte packet

the more smaller the packet the harder it is to handle

to split packet into custom amount of bytes use nmap --mtu <value>

this will split packet into your choice of bytes

while using --mtu the value must be a multiple of 8

Using decoys work by making the target think that multiple ips are scanning a single target.

This will make it harder to determine which ip are innocent and which ip are the culprit.

This can be defeated by router path tracing , response dropping and other mechanisms, but is still an effective technique to hide your ip.

nmap -D RND:5 <target>

will randomize 5 ip addresses along with ours to hide and use the scan

to specify local ips in a system we use

nmap -D <ip1>,<ip2>..... <target>

to specify yourselves just type ME

nmap -D <ip1>, ME <target>