What is an Nmap Maimon scan and how does the tool interpret responses from it?
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
Your question actually led me down an intriguing path. I first checked the Nmap documentation, which referred to issue No. 49 of Phrack magazine, where, on Nov. 8, 1996, a gentleman named Uriel Maimon wrote an article entitled "Port Scanning without the SYN flag". The documentation added that the Maimon scan uses packets with both the FIN and ACK flags set.
That seemed like a simple, reasonable explanation, until I turned to the source and read Uriel's article for fact-checking purposes. It turns out that his article described sending an initial FIN packet followed by an ACK packet and then looking for discrepancies between their TTL values.
After hearing these conflicting facts, I used Nmap to run a Maimon scan, monitoring the session with the Ethereal packet sniffer. It turns out that the Nmap documentation correctly describes Nmap's behavior: it sends packets with both the FIN and ACK flags set. This mimics the second stage (FIN/ACK) of the three-way handshake used to tear down a TCP/IP connection. The setting also provides an alternative to FIN probes, which mimic the first step of the TCP breakdown handshake, and SYN probes, which mimic the first step of the connection setup handshake.
Why would you use Maimon's FIN/ACK probe? It's simply another way of eliciting responses from systems that are configured to cloak their presence on the network. Consider it one more weapon in your probe arsenal.
Dig Deeper on Open Source Security Tools and Applications
Related Q&A from Mike Chapple
Are nonprofit organizations, like higher education institutions, subject to FTC cybersecurity regulations and oversight? Expert Mike Chapple explains.continue reading
It's important for healthcare organizations to have a clear social media policy. Expert Mike Chapple explains what needs to be in the policy to stay ...continue reading
SOC 2 evaluations can be helpful tools for organizations assessing their HIPAA compliance, but companies should not solely rely on them. Compliance ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.