In CEH v13 Module 03: Scanning Networks, the behavior of firewalls in response to ACK scans is described in detail, especially regarding stateful vs. stateless firewalls.
An ACK scan (nmap -sA) is primarily used for firewall rule analysis. Here’s how it works:
When you send a TCP ACK segment:
If the port is closed and no firewall is present, the target should respond with a TCP RST packet.
If a stateless (non-stateful) firewall is used, it typically allows or blocks packets based only on rules about IP addresses, ports, and protocol type, without tracking session state.
If a stateful firewall is used, it keeps track of connection states. Therefore:
An unsolicited ACK packet (not part of any established session) will be silently dropped, because it doesn’t correspond to any active connection.
No RST is sent back because the firewall suppresses it, recognizing it as potentially malicious or out of context.
Therefore:
No RST response = packet was silently dropped.
Silent dropping of unsolicited ACK packets = Stateful Firewall Behavior.
Option Analysis:
A. There is no firewall in place
❌ Incorrect. If there were no firewall, an RST would be sent from the closed port.
B. This event does not tell you anything about the firewall
❌ Incorrect. The lack of a response is actually meaningful and implies stateful filtering behavior.
C. It is a stateful firewall
Correct. A stateful firewall inspects the packet, sees no valid session, and drops it silently.
D. It is a non-stateful firewall
❌ Incorrect. A non-stateful firewall would typically not inspect session state, and you'd still expect to see a response (likely an RST).
Reference from CEH v13 Study Guide and Courseware:
Module 03 – Scanning Networks, Section: Nmap Scanning Techniques → TCP ACK Scan
CEH Engage Labs – Network Scanning Phase: Firewall Rule Detection using ACK Scans
