TMS zl Management and Configuration Guide ST.1.0.090213

6-21
Intrusion Detection and Prevention
Threat Detection and Prevention
If the protocol is in use, the host responds in a manner specific to the protocol
that is being queried. This example shows a query for TCP.
TCP Null Flag Scan
In this scan, the attacker attempts to discover which TCP ports are open on a
host by sending a TCP packet with no flags set, which would not occur in a
real network.
Figure 6-15. TCP Null Flag Scan, Closed Port
If the port is closed, the host returns an RST packet.
Figure 6-16. TCP Null Flag Scan, Open Port
If the port is open, the host does not respond.
Ping Scan
In this scan, the attacker attempts to discover whether a device is active or
whether ICMP can pass through the firewall by sending an ICMP Echo Request
packet.