Stateless filtering (cont)

• Can be abused to probe open ports on the internal network:

• Send packets with ACK flag set

  • Inside host will either ignore the packet or send an RST back

Notes: