The script kiddie typical nmap/zmap scans are easily detectable. There are some forks that use different headers / window sizes though but they aren't that popu

The script kiddie typical nmap/zmap scans are easily detectable. There are some forks that use different headers / window sizes though but they aren't that popular as far as I can tell from my experience. Check out the methods that start with "is_filtered_nmap_" here: https://github.com/tholian-network/firewall/blob/master/kernel/ebpf/module.c https://github.com/tholian-network/firewall/blob/master/kern...