What is the purpose of NMAP's badsum scans?

• A. They reveal the presence of a firewall or IPS
• B. They enumerate ports
• C. They detect operating system
• D. They reveal user accounts

Answer: (A)

Malformed-packet handling is the idea behind this scan. NMAP’s badsum probe sends TCP segments with deliberately invalid checksums to see how the path treats malformed traffic. Some firewalls or intrusion prevention systems in-line will validate or rewrite traffic differently from a host that isn’t behind such devices, so the way those bad packets are responded to (or not responded to) reveals the presence of a filtering device in the path. This behavior helps distinguish environments with a firewall/IPS from those without, rather than directly identifying open ports, the operating system, or user accounts.