[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-146049-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-146049-en":131},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","inverse-mapping-using-disguised-tcp-resets-1-introduction-to-scanning-and-disguised-tcp-reset-attacks","Inverse mapping using disguised TCP resets - 1 - Introduction to scanning and disguised TCP reset attacks","","The paper explains inverse mapping as a technique attackers use to infer which hosts do not exist within firewall-protected network segments by relying on differential responses. It focuses on how TCP resets become a key signal during scanning of non-existent targets and why their analysis can reveal scans in progress. It then presents a method to disguise the scan origin by using an unwitting accomplice that generates RST responses with forged source addressing, along with limitations and countermeasures.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/inverse-mapping-using-disguised-tcp-resets-1-introduction-to-scanning-and-disguised-tcp-reset-attacks/146049/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/inverse-mapping-using-disguised-tcp-resets-1-introduction-to-scanning-and-disguised-tcp-reset-attacks/146049.png","ImageObject",300,407,{"name":42,"@type":43},"Riley West","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-28","2026-08-26",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",15,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What is inverse scanning in firewall-protected networks?","Question",{"text":63,"@type":64},"In inverse scanning, a packet is sent to a target in a segment behind a firewall. No reaction suggests the host may exist, while an ICMP 'host unreachable' response indicates the host does not exist.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"Why are TCP resets relevant to inverse mapping attacks?",{"text":68,"@type":64},"TCP resets are commonly generated during these attacks and many IDS systems may not log them. A large volume of resets aimed at non-existing hosts can therefore indicate a scan in progress.",{"name":70,"@type":61,"acceptedAnswer":71},"How does the paper propose disguising the origin of a scan using TCP resets?",{"text":72,"@type":64},"The attacker sends crafted ACK packets to an unwitting accomplice with a forged source address of the target. The accomplice, assuming a legitimate connection, replies with RST to the forged address, making the attacker’s origin harder to trace.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},146049,1787735599,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,101,106,111,115,120,123,127],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":97,"doc_module":4,"doc_module_name":25,"category_name":98,"show_sort_weight":99,"slug":100},5,"Comic",60,"comic",{"id":102,"doc_module":4,"doc_module_name":25,"category_name":103,"show_sort_weight":104,"slug":105},6,"Technology",50,"technology",{"id":107,"doc_module":4,"doc_module_name":25,"category_name":108,"show_sort_weight":109,"slug":110},7,"Healthcare",40,"healthcare",{"id":112,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":113,"slug":114},8,30,"research-report",{"id":116,"doc_module":4,"doc_module_name":25,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":25,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":124,"doc_module":4,"doc_module_name":25,"category_name":125,"show_sort_weight":124,"slug":126},10,"Lifestyle","lifestyle",{"id":128,"doc_module":4,"doc_module_name":25,"category_name":129,"show_sort_weight":97,"slug":130},19,"General","general",{"code":4,"msg":82,"data":132},{"doc_id":79,"user_id":133,"nickname":42,"user_avatar":134,"doc_module":4,"category_id":112,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":107,"language":140,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":12,"update_tm":80,"read_time":144},1099523885074,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","Global Information Assurance Certification Paper  \nCopyright SANS Institute  \nAuthor Retains Full Rights  \nThis paper is taken from the GIAC directory of certified professionals. Reposting is not permited without express written permission.  \nInterested in learning more? Check out the list of upcoming events offering\"Security Essentials (Security 401)\"at [http://www.giac.org/registration/gsec](http://www.giac.org/registration/gsec)  \nInverse mapping using disguised TCP  \nresets  \nMinna Kangasluoma  \n13 April 2001  \nversion 1.2c  \n1. Introduction  \nToday's Internet is full of scans . These scans are someti5tag6tdAa6secific networks, sometimes they are completely random, searching for vulnerable hosts to use in attacks  \ninto other, better protected computers, or as slaves in distributed Denial-of-Service  \nattacks. In response, many organizations seek to protect their internal networls using different filtering devices, e.g., firewalls, to limit the traffic allowed into the network. The goal is to deny the attacker knowledge of the machines and configuration behind the  \nfirewall, as well as the services which might be vulnerable to an attack; this knowledge  \nwould allow him to target specific attacks to those machines or services .  \nWhen gathering information preparatory to an attack, the attacker needs first identify  \nspecific machines as potential targets . This can be accomplished by many means,  \nincluding searching public databases (whois, dns) or simply scanning to see which IP  \naddresses are in use. These scans come in many forms . Simple pings can be used to find  \nlive hosts. Unfortunately for the attacker, many firewalls nowadays block ping traffic,  \nforcing the attacker to use more sophisticated means. Some of these scans use the inverse  \nscanning method.  \n2. Inverse scanning  \nIn inverse scanning, the attacker sends a packet addressed to a host located in a network segment protected by a firewall. If no reaction ensues, either because the packet reached  \nthe host in question or because it was dropped by a filter, then it can be tentatively  \nconcluded that the host may exist. But if the firewall or a router sends back an ICMP  \n'host unreachable' message, the host in question does not exist. Then the attacker can  \nconcentrate on those hosts tentatively presumed to exist, and leave the non-existent hosts in peace. Note that this scan does not tell which hosts exist, only those that do not. See  \nPicture 1 for a representation of the packets exchanged.  [1]  \nTCP resets are often used for these attacks, since TCP resets are ubiquitous in the  \nInternet, and few current IDS systems bother to log them. This will change in the future, as IDS systems evolve. Resets aimed at non-existing hosts will certainly become one of the targets of analysis, for in normal use they are only seen as results of error conditions .  \nThus an abnormally large amount of resets aimed at non-existing hosts is a clear  \nindication of a scan in progress .  \n© SANS Institute 2000-2002 As part of GIAC practical repository. Author retains full rights.  \n*****  \n+++++++++++ ++++++++++++ * *  \n+ + ---------------RST--------------->+ + * *  \n+ scanner +==================================+ firewall +===* intra *  \n+ +\u003C ------ICMP Host unreachable------+ + * net *  \n+++++++++++ ++++++++++++ * *  \n*****  \nPicture 1.  \nThe problem for the attacker is that in order to gain infoto0n6rmAh6e9scan, he has to  \nprovide at least one genuine source address where he can study the returned packets.  \nMany scanning tools, e.g. nmap [2], provide a way of sending decoy packets [5] from  \nseveral forged source addresses to confuse the IDS systems . But always there is one  \ngenuine address among the rest, making the tracing of the attacker possible if not  \nprobable. This paper presents a method for disguising the origin of the scan, as well as  \nthe limitations of and countermeasures for such a scan .  \n3. Disguised TCP resets  \nIn order to disguise the origi","cbCaijy2Za9qc0Hl","https://ap.wps.com/l/cbCaijy2Za9qc0Hl","pdf",218053,"English","# 1. Introduction\n# 2. Inverse scanning\n## TCP resets as indicators\n## Need for genuine source addresses\n# 3. Disguised TCP resets\n## Unwitting accomplice and forged sources\n## Firewall/router handling and ICMP responses","[{\"question\":\"What is inverse scanning in firewall-protected networks?\",\"answer\":\"In inverse scanning, a packet is sent to a target in a segment behind a firewall. No reaction suggests the host may exist, while an ICMP 'host unreachable' response indicates the host does not exist.\"},{\"question\":\"Why are TCP resets relevant to inverse mapping attacks?\",\"answer\":\"TCP resets are commonly generated during these attacks and many IDS systems may not log them. A large volume of resets aimed at non-existing hosts can therefore indicate a scan in progress.\"},{\"question\":\"How does the paper propose disguising the origin of a scan using TCP resets?\",\"answer\":\"The attacker sends crafted ACK packets to an unwitting accomplice with a forged source address of the target. The accomplice, assuming a legitimate connection, replies with RST to the forged address, making the attacker’s origin harder to trace.\"}]","Inverse mapping using disguised TCP resets - 1 - Introduction to scanning and disguised TCP reset attacks | PDF",18]