What is an Nmap Maimon scan and how does the tool interpret responses from it?
Your question actually led me down an intriguing path. I first checked the Nmap documentation, which referred to issue No. 49 of Phrack magazine, where, on Nov. 8, 1996, a gentleman named Uriel Maimon wrote an article entitled "Port Scanning without the SYN flag". The documentation added that the Maimon scan uses packets with both the FIN and ACK flags set.
That seemed like a simple, reasonable explanation, until I turned to the source and read Uriel's article for fact-checking purposes. It turns out that his article described sending an initial FIN packet followed by an ACK packet and then looking for discrepancies between their TTL values.
After hearing these conflicting facts, I used Nmap to run a Maimon scan, monitoring the session with the Ethereal packet sniffer. It turns out that the Nmap documentation correctly describes Nmap's behavior: it sends packets with both the FIN and ACK flags set. This mimics the second stage (FIN/ACK) of the three-way handshake used to tear down a TCP/IP connection. The setting also provides an alternative to FIN probes, which mimic the first step of the TCP breakdown handshake, and SYN probes, which mimic the first step of the connection setup handshake.
Why would you use Maimon's FIN/ACK probe? It's simply another way of eliciting responses from systems that are configured to cloak their presence on the network. Consider it one more weapon in your probe arsenal.
Dig Deeper on Open Source Security Tools and Applications
Related Q&A from Mike Chapple
The rights of medical identity theft victims have been confused by health providers, but the rules under HIPAA are actually quite clear. Expert Mike ...continue reading
The New York State Department of Financial Services announced plans to increase cybersecurity regulations for financial firms. Here's what they need ...continue reading
Smaller organizations have a tougher time handling the compliance burden, specifically from the PCI DSS requirements. Expert Mike Chapple has some ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.