NMAP scan and CPAS

[JasMan]

Hi folks,

During a penetration test in our network a Nmap scan on port 80 for a complete /16 subnet was started. The source IP address was allowed to reach each IP address and excluded from the most inspections. But during the scan the load of the firewall reached 99% and the traffic flow nearly stopped.

Our service provider was not able to identify the reason. From my analyses later that day it happened due to CPAS (https://support.checkpoint.com/results/sk/sk179804).

CPAS act as a responder for HTTP requests and do a 3-way-handshake for each requested IP address, regardless if the address is online or not. It keeps sessions to offline IP addresses for 30 seconds open.

That means an aggressive Nmap scan would cause a lot of parallel new connections and a high load on the firewall until it stops working.

Is this an expected behaviour? Is it possible to reduce the 30 seconds for each connection or which is the suggested value? Any other suggestions to prevent such an issue?

Thank you.

Jas Man

[Lesley]

This SK's will maybe help you out:

https://support.checkpoint.com/results/sk/sk110873

This one is mostly about DDOS but it also speaks regarding port scans

https://support.checkpoint.com/results/sk/sk112241

[JasMan]

The second SK is very interessting. I'll check. Thx.

[G_W_Albrecht]

Using NMAP to aggressively scan the own network (best done from inside!) is an old joke that never seems to die... So this is expected behaviour.

[JasMan]

They wanted to identify unknown systems in our network which listen to http and other "bad services". I would say it's a justified action. 😇

[G_W_Albrecht]

So you should configure it not as an aggressive NMAP scan, but to proceed only very slowly and carefully !

[JasMan]

Yup, that's true. Good point!