Tools · Nmap and network discovery · 12 / 25
Using an Nmap ACK scan to check your firewall rules
Run nmap -sA against your own firewall to see which ports a stateless or stateful filter lets through, and how to read unfiltered versus filtered.
What an ACK scan asks
An ACK scan sends TCP packets with only the ACK flag set, as if they belonged to an existing connection. A host that receives an unexpected ACK replies with RST regardless of whether the port is open. So the ACK scan cannot tell open from closed. What it can tell is whether something in the path dropped the packet.
Nmap reports unfiltered when a RST came back and filtered when nothing did. Against a stateful firewall, which tracks connections, unsolicited ACKs are usually dropped, so most ports look filtered. Against a stateless filter that only checks ports, ACKs to allowed ports pass and return unfiltered.
Lab: stateless versus stateful rules
On a lab VM, write two iptables rule sets in turn. The first is stateless: allow TCP to port 80, drop everything else. The second is stateful: allow established and related traffic, allow new connections to port 80, drop everything else. ACK-scan ports 22, 80, and 443 after each.
With the stateless set, port 80 shows unfiltered and the rest filtered, mapping the allow list exactly. With the stateful set, all three usually show filtered, because the unsolicited ACK does not match an established connection. Combine with a SYN scan to see the full picture.
# stateless sudo iptables -F; sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT; sudo iptables -A INPUT -p tcp -j DROP sudo nmap -sA -p 22,80,443 192.168.56.101 # stateful sudo iptables -F sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT sudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT sudo iptables -A INPUT -p tcp -j DROP sudo nmap -sA -p 22,80,443 192.168.56.101
When defenders use it
An ACK scan is a quick way to confirm that a filter in front of a server is stateful. Stateless ACL rules on older routers and some cloud network ACLs let crafted packets through to ports you thought were closed, and the ACK scan shows that directly.
It also confirms a change. If a firewall migration was supposed to move from port-only ACLs to stateful rules, running the same ACK scan before and after gives you evidence for the change record.
Limits of the result
Unfiltered never means open. Follow up with -sS or -sT to learn whether a service is actually listening on an unfiltered port.
Host-based firewalls and network firewalls stack. An ACK scan tells you about the combined path, so test from inside and outside the network boundary separately when you need to attribute a result to one device.
Diagram
ACK scan results by firewall type
The same probe reveals how the filter makes decisions.
Port 80 allowed. ACK passes, host sends RST: unfiltered.
Other ports. Dropped: filtered.
Lesson. The allow list is visible to crafted packets.
Port 80 allowed. Unsolicited ACK has no connection: dropped.
Other ports. Dropped: filtered.
Lesson. Only real handshakes get through.
Check yourself
1. What does “unfiltered” mean in an ACK scan?
2. All ports, including an allowed web port, show filtered in an ACK scan. What does that suggest?
3. How do you learn whether an unfiltered port is actually listening?