How does Nmap bypass firewalls?

Nmap can bypass firewalls using several techniques, including:

Host Discovery Bypass: Using the -Pn option, Nmap skips host discovery, allowing it to scan hosts that may block ICMP echo requests (ping). This is useful for scanning devices that do not respond to standard discovery methods.
Packet Fragmentation: The -f option fragments IP packets into smaller pieces. This can help evade stateless packet filters that may not reassemble packets for inspection, making it harder for firewalls to detect the scan.
Timing Options: Nmap provides various timing templates (e.g., -T0 to -T5) that allow users to adjust the speed of the scan. Slower scans can help avoid detection by intrusion detection systems (IDS) and firewalls.
Decoy Scanning: The -D option allows Nmap to use decoy IP addresses, making it appear as if the scan is coming from multiple sources. This can confuse firewalls and IDS, making it harder to trace the actual source of the scan.
Source Port Specification: By using the --source-port option, Nmap can specify a source port that is commonly allowed through firewalls (e.g., port 80 for HTTP), which may help bypass restrictions.
Protocol Manipulation: Nmap can use different protocols (TCP, UDP, ICMP) and options to test how firewalls respond to various types of traffic, allowing for more effective evasion strategies.

These techniques enable security professionals to assess the effectiveness of firewalls and identify potential vulnerabilities in network defenses. However, it's essential to use these methods only in authorized assessments to comply with legal and ethical standards.