Originally posted here by White Scorpion
yeah ok, but you would still have to be able to monitor the network traffic and examin the packages.

but normally when you have just an ip with no server running (that you know of) and you aren't able to monitor traffic, (especially with an hardware firewall) i doubt it will be so easy. and that is what i was trying to say... of course when you are running a webserver it would be a lot harder to block (maybe even impossible).
Hardware firewalls are overrated. Our guys just spent the past 9 hours un-*****ing the network after a cisco pix HA pair **** the bed and then brought all interfaces online at the same time. Which by the way causes multiple loops in the network, which is illegal on ethernet networks....

Monitor? We are talking about port scanning here aren't we. Scanning through firewalls is a very basic black hat skill, and anybody who doesn't know how isn't a hacker.

If I can get a MAC address, a couple of DHCP pings, and maybe a couple hundred rejected packets I can make a pretty good guess as to the hardware of the machine, and the OS.

Networking was designed to be predictable, that will always trump cheap (obscurity *)security tricks!

-- spurious