Firewall and IDS Evasion

Fragmentation

-f splits probes into tiny IP fragments so a filter that inspects only the first fragment may miss the TCP header.

sudo nmap -f -p 22,80,443 10.0.0.5
sudo nmap -ff -p- 10.0.0.5
sudo nmap --mtu 16 -p 80 10.0.0.5           # equivalent to -ff
sudo nmap --mtu 24 -p 80 10.0.0.5

Honest assessment: fragmentation defeats almost nothing modern. Every current firewall and IDS reassembles fragments before inspection, and many drop tiny fragments outright as an anomaly, so -f is more likely to get you noticed or get your probes discarded than to slip past. It still has value against old embedded ACLs and in CTF settings.

Decoys and source spoofing

sudo nmap -D 10.0.0.11,10.0.0.12,ME,10.0.0.13 -p 80 10.0.0.5
sudo nmap -D RND:10 -p 80 10.0.0.5
sudo nmap -S 10.0.0.99 -e eth0 -Pn -p 80 10.0.0.5
sudo nmap --spoof-mac 0 -p 80 192.168.1.10          # random MAC
sudo nmap --spoof-mac Cisco -p 80 192.168.1.10      # a Cisco OUI
sudo nmap --spoof-mac 00:1B:44:11:3A:B7 192.168.1.10

The critical limitation: -S gives you no results. Replies go to the spoofed address, not to you, so a fully spoofed scan is write-only unless you also control that host or can sniff the return path. Decoys are different, your real probes are in the mix, so results come back while the logs show many candidate sources.

Decoys also do not survive analysis. Only one source in the set completes behaviour consistent with a real scanner, and the decoy addresses have to be live or the target's ARP and routing behaviour gives them away.

Source port and payload padding

Some firewalls trust traffic from ports 53, 20, or 88, a legacy of stateless rules written for DNS and FTP.

sudo nmap -g 53 -p 1-1024 10.0.0.5              # pose as DNS traffic
sudo nmap --source-port 88 -p 445 10.0.0.5
sudo nmap --data-length 25 -p 80 10.0.0.5       # break the fixed-size signature
sudo nmap --data-string 'GET / HTTP/1.0' -p 80 10.0.0.5
sudo nmap --ttl 8 -p 80 10.0.0.5
sudo nmap --badsum -p 80 10.0.0.5               # probe for a device that ignores checksums

--data-length exists because default nmap probes are empty and therefore a fixed size, which is itself a signature. --badsum is a detection trick rather than evasion: a reply to a bad-checksum packet proves a middlebox answered, since a real host's stack would have discarded it.

Timing as evasion

The most effective evasion is not a special flag, it is being slow enough to stay under a threshold.

sudo nmap -T0 -p 22,80,443 10.0.0.5              # 5 minutes between probes
sudo nmap -T1 --max-retries 1 -p- 10.0.0.5
sudo nmap --scan-delay 5s --max-rate 2 -p 1-1024 10.0.0.5
sudo nmap --randomize-hosts -p 80 10.0.0.0/16    # shuffle host order

Threshold-based detection fires on probe volume per interval. A scan at two packets per second across a shuffled target list looks like background noise, where a -T4 -p- sweep is unmistakable. The tradeoff is real: -T0 on 1000 ports is measured in days.

Proxies, and the ACK scan for rule mapping

nmap -sT --proxies socks4://127.0.0.1:9050 -Pn -p 80,443 10.0.0.5
nmap -sT --proxies http://proxy:3128 -Pn -p 80 10.0.0.5
sudo nmap -sA -p- 10.0.0.5                       # which ports are filtered at all
sudo nmap -sW -p- 10.0.0.5                       # window scan, occasionally distinguishes

--proxies works only with -sT and -sV, because a raw-packet scan cannot be relayed. Combined with -Pn it routes a connect scan through Tor or a SOCKS tunnel, which changes the apparent source at the network level in a way -S cannot.

An ACK scan is a reconnaissance tool rather than an evasion: it does not find open ports, it finds which ports a stateless filter blocks. Comparing -sS and -sA output tells you where the firewall sits.

What modern defenses still catch

Being honest about this matters more than the flag list.

What a current stateful firewall, NIDS, or EDR agent still sees: fragment reassembly, connection attempts to closed ports at any rate, probe patterns across many ports even when shuffled, and TLS or service handshakes that do not match a real client. Assume a competently monitored network will log the scan. Evasion buys time and ambiguity about the source, not invisibility.

For authorized work this rarely matters, and coordinating with the defenders beats evading them. Test the detection deliberately instead, and use evasion flags to answer a specific question such as "does this rule inspect fragments", not as a default posture.