I've always wondered what the actual best practice is with rejection rules. I tend to prefer issuing reset/unreachable since as the article points out it does m

I've always wondered what the actual best practice is with rejection rules. I tend to prefer issuing reset/unreachable since as the article points out it does make the port look like it's truly unused. On the other hand, eliminating the response packets has benefits of its own: the scan takes longer, the system doesn't incur the response overhead and it won't participate in any attack scenario depending on sending responses to a spoofed address.