Stealth Scanning: Bypass Firewalls

You've locked down your target's perimeter, or so you thought. A firewall sits between you and your objective, silently dropping your SYN packets and logging every probe you send. Every scan you run gets flagged, your IP gets blocked, and the window of opportunity slams shut. This is the reality of modern penetration testing — the noisy, default nmap -sS scan from your penetration testing distro won't cut it when a stateful firewall is watching. In this lesson, you'll learn how to bypass firewalls with stealth scanning — not by shouting louder, but by whispering so quietly that the firewall's logging daemon never even wakes up.

The problem this lesson solves

Firewalls are the gatekeepers of every network. They inspect traffic at the perimeter, on the host, and increasingly inside the network itself. The moment you launch a standard TCP connect scan (-sT) or even a SYN scan (-sS), the firewall's stateful inspection engine correlates your packets with an expected handshake sequence. Too many incomplete handshakes? Your source IP gets a rule added to a blocklist. The scan fails, the engagement report shows no findings, and the client wonders why you were even hired.

The core problem is visibility. A firewall that can see your scan will eventually stop it. Therefore, the solution isn't to scan more aggressively — it's to scan in a way that the firewall either can't parse, doesn't care about, or mistakes for normal traffic. This is what stealth scanning means in practice: reducing your footprint to the point where your probes are indistinguishable from background noise.

Pro tip: Stealth scanning is not about evading detection forever — it's about buying enough time and deniability to complete your objective before the blue team's SIEM catches on.

Core concept / mental model

Think of a firewall like a bouncer at a nightclub who checks every ID at the door. A standard scan is like you handing the bouncer a fake ID that he's already seen a hundred times — he knows it's fake and kicks you out. A stealth scan is like slipping through a service entrance when the bouncer is distracted, or using an ID that he's not trained to recognize.

The key insight is that firewalls make decisions based on state. Stateful firewalls track the three-way handshake: SYN, SYN-ACK, ACK. If they see a SYN that never completes, they assume the host is being scanned and log it. If they see an ACK packet that wasn't part of any established connection, they may drop it or deliver it to the application — this is where your opportunity lies.

Here are the core definitions you'll need:

• Stateful inspection: The firewall tracks connection state; any packet that doesn't fit an existing session is suspect.
• Stateless filtering: The firewall only checks header fields (source/dest IP, port) — it is deaf to connection state.
• Stealth scan: Any scan technique designed to appear as normal traffic, avoid logging, or bypass firewall rule sets.
• Decoy scan: A scan that uses spoofed source IPs to confuse the firewall's attribution.
• Fragmentation: Splitting packets into fragments so the firewall's deep packet inspection (DPI) engine can't reassemble the payload.

The mental model: You are not trying to defeat the firewall in a head-on collision. You are trying to make your scan look like a series of coincidental packets that the firewall's rule set either ignores or passes through to the application layer.

How it works step by step

The step-by-step logic for bypassing firewalls with stealth scanning follows a careful, methodical process:

1. Reconnaissance (passive first): Before you send a single packet, gather data passively. Use OSINT sources, certificate transparency logs, and search engines to map the target's open ports and services. This reduces the amount of scanning you must do.
2. Probe with legit-looking traffic: Begin with a TCP connect scan to a few common ports (80, 443, 22). This is the most "normal" traffic you can generate and often passes without a second look.
3. Switch to stealth techniques: Once you know the firewall is active (your initial probes get dropped or you see ICMP unreachable messages), deploy techniques like SYN scans with custom packet rates, or TCP half-open scans.
4. Use decoys: Launch your scans with -D (decoy) in Nmap, adding a few spoofed IPs so the firewall's blocklist becomes cluttered with garbage entries.
5. Fragment your packets: Split your scan across multiple fragmented packets (-f flag in Nmap) to bypass firewalls that don't reassemble fragments before filtering.
6. Analyze responses: Stealth scans rely on subtle responses. An open port may respond with a SYN-ACK, a closed port with an RST, and a filtered port with nothing or an ICMP error. Learn to read these signals.
7. Document everything: In a professional assessment, you must log every technique attempted and the result — this is your evidence chain for the final report.

Cause → effect: Each technique produces a specific response pattern. SYN scan causes a SYN-ACK on open ports and RST on closed; fragmentation causes the firewall to fail to apply DPI rules; decoy scans cause the firewall to block random IPs while your actual IP remains free.

Hands-on walkthrough

Now let's apply this in a practical exercise. You'll use Nmap (the de facto standard) in a lab environment. Ensure you have authorization — never scan systems you don't own or have explicit permission to test.

First, let's confirm the firewall is active. Use a standard connect scan to see how the firewall reacts:

# Standard TCP connect scan against a target with firewall enabled
nmap -sT -p 80,443,22 -v 192.168.1.105

Expected output (if the firewall is dropping packets):

PORT     STATE    SERVICE
22/tcp   filtered ssh
80/tcp   filtered http
443/tcp  filtered https

All ports show filtered — the firewall is dropping your packets, so you get no response. This confirms you need stealth techniques.

Now, let's use a SYN scan with a stealthy packet rate and decoys:

# SYN scan with decoys and a slower, less noticeable pace
nmap -sS -p 22,80,443 -D 192.168.1.10,192.168.1.20,192.168.1.30 -T2 192.168.1.105

Expected output (if a firewall allows SYN packets but blocks scans):

PORT     STATE    SERVICE
22/tcp   open     ssh
80/tcp   open     http
443/tcp  open     https

The decoys confuse the firewall's state table; your real IP is just one of four sources, and the firewall can't single you out.

Next, try fragmentation to bypass DPI filters:

# Fragment packets to evade DPI-based firewall rules
nmap -sS -p 80,443 -f -T2 192.168.1.105

Expected output (if the firewall doesn't reassemble fragments):

PORT     STATE    SERVICE
80/tcp   open     http
443/tcp  open     https

If a firewall only inspects the first fragment and passes the rest, your scan gets through.

Finally, a more advanced technique — using idle scan via a zombie host. This makes the target think the scan is coming from an innocent third party:

# Idle scan through a zombie host (192.168.1.200) — target sees packets from zombie, not you
nmap -sI 192.168.1.200 -p 80,443 192.168.1.105

Expected output (when the zombie is a good IP ID source):

Idle scan using zombie 192.168.1.200:80; Class: Incremental
PORT     STATE    SERVICE
80/tcp   open     http
443/tcp  open     https

The target's firewall logs the zombie's IP, not yours — complete deniability.

Pro tip: Always run these scans with -v (verbose) to see live responses, and consider saving outputs to a file for evidence (-oN scan.txt).

Compare options / when to choose what

Different stealth scanning techniques have different trade-offs. Here's a comparison table to help you choose the right one for the situation:

When to choose what:

• For a quick assessment, start with SYN scan plus decoys.
• If you face DPI (deep packet inspection), use fragmentation.
• If the target has robust logging and the engagement requires complete deniability, sacrifice speed for an idle scan using a stable, incrementing IP ID host.

Troubleshooting & edge cases

Stealth scanning is as much about interpreting failures as successes. Here are common issues and how to resolve them:

• All ports show filtered even with -sS: The firewall is dropping SYN packets entirely. Try ACK scan (-sA) to see if the firewall responds with RST — this reveals a stateful vs. stateless filter. Use fragmentation or idle scan as a last resort.
• Decoy scan returns no results: The target may have an IDS that correlates multiple probes from different IPs as a coordinated attack. Reduce the number of decoys or slow the scan rate (-T1).
• Idle scan fails — zombie not incrementing IP ID: The zombie host is behind a NAT or is using a randomized IP ID. Pick another zombie (use -O to check its OS).
• Firewall resets your session after a few packets: Logs may show your IP and block you after a threshold. Use --max-rate to limit packets per second, and rotate through decoys.
• Fragmentation gets blocked: Some modern firewalls reassemble fragments before inspection. Combine fragmentation with decoys, or use --mtu to tweak the fragment size and evade reassembly logic.
• Scan results show filtered but you get an ICMP port unreachable: This indicates a stateless firewall that sends ICMP for closed ports. Use that response to map the firewall rules.

What you learned & what's next

You now understand that bypassing firewalls with stealth scanning isn't about a single magical command — it's a strategic process. You learned the core concept of stateful vs. stateless inspection, and how techniques like SYN, decoy, fragmentation, and idle scans exploit those models. You completed a hands-on exercise demonstrating each technique, and you can now compare their trade-offs and troubleshoot common failures. This directly satisfies the learning objectives: you can explain the core idea behind stealth scanning and apply it in a practical exercise.

As the next step in your Ethical Hacking track, you'll move into evading detection after exploitation — learning how to maintain persistence and clean up logs without raising alarms. Stealth scanning is your first step into the art of invisibility; next you'll master the art of staying unseen even after you've breached the perimeter.