As part of a compliance audit, I need to run a routine scan that verifies that our firewalls are performing stateful packet inspection on incoming packets. I have a dedicated server outside our network, on which I can run nmap or whatever software I need to, and scan the external port of our firewall.
The compliance audit manual says I should "run NMAP on all TCP ports with “syn reset” or ”syn ack” bits set", and that a response means 'packets are being allowed through even if they're not part of a previously established session'
What are the nmap switches I need to scan a range of IP addresses - in this case a single /28 subnet - and report on which ports are open and whether the firewall is performing SPI?
Server is Windows 2008; nmap version 5.21 is installed and working.