### Tool 79: Acknowledge every TCP SYN

### Description:

      This tool acknowledges every TCP-SYN. It is used to protect against
      scanning tools.
      For example, host 192.168.0.1 has a webserver on port 80. A scan will
      quickly find this open port. Dropping packets on other ports will slow
      the scan, but it will finally find port 80 open.
      This tool answers to TCP SYN (except for port 80), so from scanner
      viewpoint, all ports will be open. In this case, use netwox like this:
        netwox 79 --ips 192.168.0.1 --ports 1-79,81-65535
      Don't forget to DROP packets in kernel firewall, otherwise, scanner
      will see a SYN-ACK and a RST.
      Parameter --device indicates on which device to sniff. Please note
      that under some systems, such as Windows, sniffing on some devices is
      not supported.
      Parameter --filter defines the sniff filter. It permits to restrict
      captured packets. This kind of filter is named a BPF or pcap filter.
      Basic elements of a filter are:
        host 1.2.3.4
        net 192.168.10
        net 192.168.10.0 mask 255.255.255.0
        net 192.168.10.0/24
        port 21
        dst host 1.2.3.4
        src port 2345
        ether host a:b:c:d:e:f ('ether a:b:c:d:e:f' is not working)
        ether src aa:bb:cc:dd:ee:ff
        ip
        arp
        rarp
        tcp
        icmp
        udp
      Here are filter examples:
        "host 1.2.3.4"
        "net 192.168 and icmp"
        "host 1.2.3.4 or dst port 80"
        "(udp or tcp) and not host 1.2.3.4"
      Parameter --spoofip indicates how to generate link layer for spoofing.
      Values 'best', 'link' or 'raw' are common choices for --spoofip. Here
      is the list of accepted values:
       - 'raw' means to spoof at IP4/IP6 level (it uses system IP stack). If
         a firewall is installed, or on some systems, this might not work.
       - 'linkf' means to spoof at link level (currently, only Ethernet is
         supported). The 'f' means to Fill source Ethernet address.
         However, if source IP address is spoofed, it might be impossible
         to Fill it. So, linkf will not work: use linkb or linkfb instead.
       - 'linkb' means to spoof at link level. The 'b' means to left a Blank
         source Ethernet address (0:0:0:0:0:0, do not try to Fill it).
       - 'linkfb' means to spoof at link level. The 'f' means to try to Fill
         source Ethernet address, but if it is not possible, it is left
         Blank.
       - 'rawlinkf' means to try 'raw', then try 'linkf'
       - 'rawlinkb' means to try 'raw', then try 'linkb'
       - 'rawlinkfb' means to try 'raw', then try 'linkfb'
       - 'linkfraw' means to try 'linkf', then try 'raw'
       - 'linkbraw' means to try 'linkb', then try 'raw'
       - 'linkfbraw' means to try 'linkfb', then try 'raw'
       - 'link' is an alias for 'linkfb'
       - 'rawlink' is an alias for 'rawlinkfb'
       - 'linkraw' is an alias for 'linkfbraw'
       - 'best' is an alias for 'linkraw'. It should work in all cases.

      This tool may need to be run with admin privilege in order to sniff
      and spoof.

### Synonyms:

firewall

### Usage:

netwox 79 -i ips -p ports [-d device] [-f filter] [-s spoofip]

### Parameters:

parameter | description | example
`-i|--ips ips` | only answer to these IP | all
`-p|--ports ports` | only answer to these ports | all
`-d|--device device` | device name | Eth0
`-f|--filter filter` | pcap filter |
`-s|--spoofip spoofip` | IP spoof initialization type | linkbraw

### Examples:

netwox 79 -i "all" -p "all"
netwox 79 --ips "all" --ports "all"