Using nmap to do a protocol discovery (nmap myhost -sO)
identifies the following on my target. Note reason switch is also used.
PROTOCOL STATE SERVICE REASON
1 open icmp echo-reply ttl 255
6 open tcp proto-response ttl 255
If I then add the -f to fragment the packets to evade ids / firewall (nmap myhost -sO -f)
the scan no longer reports TCP as a protocol and only reports ICMP
PROTOCOL STATE SERVICE REASON
1 open icmp echo-reply ttl 255
Why does fragmenting the packets stop detection of TCP, is the firewall actively dropping these or does it not understand them?
Update:
I tried manually setting mtu in increments of 8 until I discovered TCP again and this occurs at mtu 24 . So nmap myhost -sO -mtu 24
and it's back to
PROTOCOL STATE SERVICE
1 open icmp
6 open tcp