Using nmap to do a protocol discovery
(nmap myhost -sO) identifies the following on my target. Note reason switch is also used.
PROTOCOL STATE SERVICE REASON 1 open icmp echo-reply ttl 255 6 open tcp proto-response ttl 255
If I then add the -f to fragment the packets to evade ids / firewall
(nmap myhost -sO -f)
the scan no longer reports TCP as a protocol and only reports ICMP
PROTOCOL STATE SERVICE REASON 1 open icmp echo-reply ttl 255
Why does fragmenting the packets stop detection of TCP, is the firewall actively dropping these or does it not understand them?
I tried manually setting mtu in increments of 8 until I discovered TCP again and this occurs at mtu 24 . So
nmap myhost -sO -mtu 24
and it's back to
PROTOCOL STATE SERVICE 1 open icmp 6 open tcp