Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe reliable way to test a firewall is to compare an expected rule matrix with three observations: Nmap’s response state, a packet capture taken on the traffic path, and the firewall’s own log. Run a bounded SYN scan for reachability, an ACK scan when you need to investigate filtering, and capture the exchange with tcpdump before sending probes.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Every result is specific to a source address, route, protocol, destination interface, and moment in time. A result from one network location cannot prove that every firewall rule is correct, so test each authorized vantage point and preserve the commands, pcaps, and logs together.
As an Amazon Associate I earn from qualifying purchases.
Start with authorization, scope, and a stop condition
Obtain written authorization before scanning. The Nmap Project’s legal guidance recommends securing written authorization from the representatives of the target network before initiating any scan. Treat that approval as an engineering control, not paperwork: it defines what you may test and gives operators a clear way to stop the work.
Your written scope should identify:
- The source networks, hosts, VPN pools, or test addresses that will originate probes.
- Destination hosts and interfaces, including IPv4 or IPv6 details when both are in use.
- Protocols and ports, with separate entries for TCP, UDP, and ICMP where applicable.
- The test window, scan rate or other traffic limits, and a contact who can halt the test.
- Stop conditions, such as an unexpected service impact, a rise in error rates, or traffic reaching an out-of-scope system.
- How captures and logs will be stored, who may access them, and when they will be deleted.
Do not expand a port list or add a new source location during the run without updating the authorization and the test record.
#1 Best Overall
- Used Book in Good Condition
Turn the policy into an expected-result matrix
Before starting tcpdump, translate each firewall rule into a test row. The matrix makes an ambiguous result actionable because it states what should happen and what evidence should exist.
| Source vantage point | Destination and protocol | Port or type | Expected policy | Expected log |
|---|---|---|---|---|
| External test network | DMZ host, TCP | 443 | Allow | Connection or session permitted |
| External test network | DMZ host, TCP | 22 | Deny | Denied connection recorded |
| VPN address pool | Internal host, TCP | 22 | Allow for the authorized administrator range | Permitted connection with source identity |
| Guest or untrusted segment | Internal host, ICMP | Echo request | Deny | Drop or reject recorded, according to policy |
| Routed server segment | Application host, UDP | Service-specific port | Allow or deny as documented | Decision recorded if logging is enabled |
The rows above are examples of how to structure a plan, not a claim about your network. Replace them with the exact addresses, ports, and logging expectations in the approved change or security policy. Add a row when stateful context matters: a new connection, a return packet for an established flow, and an unsolicited packet can follow different rules.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsCapture the traffic before running Nmap
Choose the interface that carries the test
Start tcpdump on the scanner, firewall, or monitoring point whose interface actually sees the test path. A capture on the wrong VLAN, a management interface, or a point that sees only one direction can look empty even when packets are moving. Confirm whether the chosen interface exposes both ingress and egress traffic; many devices show only one side of a forwarded flow on a particular interface.
For the example destination in the approved lab scope, begin a capture with:
sudo tcpdump -ni eth0 -w firewall-test.pcap 'host 192.0.2.10 and (tcp or icmp)'Here, -i eth0 selects the interface, -n prevents name lookups while displaying packets, and -w writes the matching packets to a pcap file instead of rendering a live decode. The Boolean expression limits the capture to traffic involving 192.0.2.10 and to TCP or ICMP. tcpdump’s manual describes this model: it prints packets on an interface that match a Boolean expression, can save them with -w, and can read a saved file later with -r.
Protect and annotate the capture
Record the capture start time, interface, host, source address, route, and the person who started it. Payloads can contain credentials, tokens, addresses, or other sensitive data, so apply the same access controls used for firewall logs. Use a timestamped filename if several test cases will run, while retaining the exact filename in the test record.
When the authorized probes are complete, stop tcpdump with the normal interrupt signal and note its packet count and kernel-drop count. A nonzero drop count means the capture may not contain every packet; it is an evidence limitation, not proof that the firewall dropped traffic.
Run a bounded SYN scan for baseline reachability
With the capture running, execute a narrowly scoped TCP SYN scan against only the policy ports:
nmap -n -Pn -sS -p 22,80,443 192.0.2.10The options have specific purposes:
-sSsends a SYN-based scan that tests the TCP handshake without completing ordinary application connections.-p 22,80,443restricts the probe to the ports in the test matrix. A bounded list reduces noise and makes packet-to-result correlation practical.-ndisables reverse-DNS lookups, avoiding name-resolution delays and ambiguity.-Pnskips host-discovery assumptions and treats the target as up. Use it when discovery probes are expected to be blocked; otherwise, document why it is needed because it changes what the scan is testing.
Save the exact command, the source address selected by the operating system, the route used, the destination interface if known, and the Nmap version. Those details are part of the result, not incidental notes.
For a SYN probe, an open TCP service normally produces a SYN-ACK, after which the scanner sends a reset rather than completing an application session. A closed port commonly produces a TCP reset. A filtering device may send nothing or return an ICMP error, leaving Nmap unable to decide whether an application is listening.
Use an ACK scan to investigate filtering behavior
After the SYN test, run an ACK scan against the same bounded port set when the question is whether packets are being filtered:
nmap -n -Pn -sA -p 22,80,443 192.0.2.10An ACK scan is designed to map whether probes are reaching the target through a filtering device. It commonly reports unfiltered when responses show that the probe was not blocked and filtered when a firewall or other obstacle prevents a conclusion. It does not establish that an application is listening, because an ACK probe is not a service-opening SYN exchange. Pair its state with the SYN result, packet capture, and policy log.
Do not infer that a port is safe merely because an ACK scan says unfiltered, or that it is closed merely because the SYN scan did not show open. The scan type determines what Nmap can conclude.
Read the pcap as a packet-level explanation
After stopping the capture, inspect it numerically so DNS and service-name lookups do not obscure the addresses and ports:
tcpdump -nn -r firewall-test.pcapFor a focused review of the TCP control exchange, use:
tcpdump -nn -r firewall-test.pcap 'tcp[tcpflags] & (tcp-syn|tcp-ack|tcp-rst) != 0'For each matrix row, look for the following sequence:
- A SYN leaving the scanner with the expected source and destination addresses and port.
- A SYN-ACK returning when the destination accepted the connection attempt.
- A reset returning when the host or a device actively rejected the attempt.
- An ICMP unreachable or administratively prohibited message that explains a filtering result.
- No response at all, while remembering that the capture point may not see the return path and that a kernel drop can hide packets.
Compare packet flags, TTL or hop details when useful, source and destination MAC addresses on a local segment, and timestamps with the Nmap output. A reset generated by an intermediate firewall can look like a closed port to Nmap. Nmap specifically warns that some firewalls can forge RST packets, so determine whether the reset came from the expected target path and reconcile it with the firewall log.
Interpret Nmap states without overclaiming
| Nmap state | What Nmap observed | What to verify in tcpdump and logs | What the state does not prove |
|---|---|---|---|
| open | An application accepted the probe, normally evidenced by a SYN-ACK for a SYN scan. | Confirm the SYN/SYN-ACK exchange, the expected destination host, and a permitted-session log. | It does not prove that every source network can reach the service or that the application is healthy beyond the handshake. |
| closed | The host or an active reject path returned a TCP reset. | Identify the reset source and compare its timing and packet details with the firewall and host logs. | It does not always prove that the destination host itself generated the reset; a firewall may forge one. |
| filtered | A firewall, filter, or other obstacle prevented Nmap from deciding open versus closed, often through silence or an ICMP error. | Check for a dropped SYN, an ICMP unreachable or administratively prohibited message, and the corresponding policy decision. | It does not identify which device blocked the packet, and it does not prove that no service is listening. |
| unfiltered | The probe reached the target, but that scan type could not determine open versus closed; ACK scans commonly produce this state. | Verify that a response crossed the path and determine the service state with an appropriate SYN or application test. | It does not prove that an application accepts new connections. |
The Nmap Project summarizes the distinction this way: where possible, Nmap separates reachable-but-closed ports from ports that are actively filtered. Its reference guide defines filtered as a condition in which a firewall, filter, or other obstacle blocks the port so Nmap cannot tell whether it is open or closed.
Recommended Free Tools
Repeat the same test from every relevant vantage point
A firewall policy can intentionally produce different answers for different source locations. Repeat the matrix without changing the destination or port list from each authorized path that the policy distinguishes.
| Vantage point | Why it matters | Metadata to record |
|---|---|---|
| Outside or internet test network | Exercises the perimeter path, public address translation, and external policy. | Public source address, provider route, destination public address, and perimeter interface. |
| Inside network | Tests internal segmentation and whether hairpin or split-routing behavior changes the path. | Source VLAN, internal route, destination interface, and any internal firewall hop. |
| VPN | Checks rules based on the VPN address pool, user group, or tunnel interface. | Assigned VPN address, identity or group context where permitted, and tunnel route. |
| Routed server or guest segment | Exposes east-west segmentation rules that an external scan cannot reach. | Segment identifier, gateway, source address, and route through each security device. |
Different answers are not automatically inconsistent. Source addresses, routes, filtering devices, and target interfaces can all change the observed state. Put the vantage point in every result filename or table row so an isolated open or filtered label cannot be mistaken for a global property of the port.
Handle UDP and other protocols separately
The SYN and ACK commands test TCP behavior only. For UDP, silence can mean that a firewall filtered the datagram, that the service is inactive, or that the service does not send a response to the particular payload. Add a safe application-level probe when the service protocol allows one and the authorization covers it. Record the exact payload or probe method, because a generic UDP packet and a valid protocol request can traverse different inspection rules.
Apply the same discipline to ICMP: distinguish an echo request from an unreachable message and record whether the policy expects a reply, a reject, or silent dropping. Do not treat the absence of an ICMP response as proof that all traffic to the host is blocked.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Reconcile the three evidence sources
For every matrix row, place the Nmap state, packet observations, and firewall decision side by side.
| Evidence source | Question it answers | Typical limitation |
|---|---|---|
| Nmap output | What response state did the scanner infer for this scan type? | The inference depends on source, route, protocol, scan type, and target interface. |
| tcpdump pcap | Which packets were visible at the capture point, with what flags and timestamps? | A wrong interface, one-way visibility, or capture drops can hide part of the exchange. |
| Firewall log | Which rule and action did the device record? | Logging may be disabled, sampled, delayed, or generated by a different device than the capture point. |
When the three views agree, confidence in that path and time window increases. When they disagree, preserve all artifacts and investigate the path rather than choosing the most convenient explanation. For example, a firewall log showing a deny with no SYN visible on a downstream interface is consistent with a drop at that firewall; a SYN visible leaving the scanner but absent from the firewall log suggests a routing, capture, or logging problem that needs separate resolution.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common contradictory results
Nmap reports filtered, but the rule says deny
A deny rule can be implemented as a silent drop, which commonly yields filtered. Check whether the policy intentionally rejects with a reset or ICMP error instead. Confirm that the deny rule matched the actual source address, destination address after translation, interface, and protocol. Then verify the packet reached the device whose log you inspected. If the capture shows no response, do not reinterpret silence as a closed port.
Nmap reports closed even though the policy says deny
Inspect the reset in the pcap. If it came from an intermediate firewall or load-balancing device, the device may be actively rejecting the connection or forging a reset, producing a closed result even though no application listener is exposed. If the reset came from the destination host, the firewall may have allowed the probe and the host may simply have no listener on that port. Compare the source of the reset with the expected policy log.
Nmap reports open, but no application access is expected
Verify the source vantage point first; a rule may allow the VPN or an internal segment while denying the external path. Check for destination translation, multiple interfaces, and a different host behind the tested address. Confirm the SYN-ACK and the permitted-session log, then test the policy row from each other authorized location rather than changing the interpretation of the successful path.
The pcap is empty or missing one direction
Confirm the interface name, link state, capture filter, and route. A filter restricted to TCP and ICMP will not show UDP. Check whether the monitoring point sees ingress, egress, or only locally terminated traffic. Review tcpdump’s packet and kernel-drop counters and repeat with a temporary, narrowly scoped filter if the authorization permits it. Do not use an incomplete capture to claim that no packet crossed the firewall.
Two locations produce different states
Keep both results. Compare source addresses, routes, NAT, intermediate filtering devices, and target interfaces. An open result from one location and filtered from another can be the intended segmentation policy. The result is meaningful only when labeled with its vantage point and scan type.
Create a defensible test record
For each test row, retain:
- Written authorization identifier, scope, window, and stop conditions.
- Source vantage point, source address, destination address, route, and interface details.
- Protocol, port or ICMP type, expected action, and expected logging.
- Exact Nmap command, Nmap version, start and stop times, and raw output.
- Exact tcpdump command, capture interface, pcap filename, packet count, and kernel-drop count.
- Firewall log entries with timestamps, rule identifiers, action, translated addresses, and device name.
- Any host or application response used to clarify a UDP or service-level result.
- A conclusion limited to the tested path, protocol, source, destination, and time.
Timestamp pcaps and commands together so another engineer can match a SYN in the capture to the corresponding Nmap line and firewall event. Restrict access to the artifacts because captures may contain payload data.
Free tools Windows power users keep installed
One-click scans. No signup required.
Know what the test proves—and what it cannot
This method proves how a particular probe traversed a particular path at a particular time. It can demonstrate that a SYN-ACK, reset, ICMP error, or no visible response occurred and can show whether the firewall logged an allow or deny. It cannot, by itself, prove that every rule, source network, protocol, route, interface, or future state behaves the same way.
Stateful policies are especially time-dependent. A new SYN, a return packet for an established connection, and an unsolicited ACK can be evaluated differently. Include the connection context in the matrix and avoid extrapolating from one packet type to another. Likewise, a successful TCP handshake says little about application authorization, authentication, or behavior after the connection is established.
No single Nmap state, pcap, or log entry is a complete configuration audit. The useful conclusion is the reconciled statement: from this authorized source, to this destination and port, using this protocol and scan type, these packets were observed, Nmap reported this state, and this firewall decision was logged.
Further reading
The Nmap Project’s guidance on determining firewall rules and its Nmap Reference Guide explain the meanings and limits of open, closed, filtered, and unfiltered. The Linux tcpdump(8) manual documents interface selection, Boolean capture expressions, pcap writing with -w, and later inspection with -r.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a deeper treatment of scan behavior and packet interpretation, the Nmap Project identifies Nmap Network Scanning by Gordon “Fyodor” Lyon, ISBN 978-0-9799587-1-7.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
