diff --git a/scan_engine.cc b/scan_engine.cc index 762972562..27ad31468 100644 --- a/scan_engine.cc +++ b/scan_engine.cc @@ -4102,10 +4102,6 @@ static bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) { /* Yeah! An open port */ newstate = PORT_OPEN; current_reason = ER_SYNACK; - } else if (USI->scantype == SYN_SCAN && tcp->th_flags == TH_SYN) { - /* A SYN from a TCP Split Handshake - open port */ - newstate = PORT_OPEN; - current_reason = ER_SYN; } else if (tcp->th_flags & TH_RST) { current_reason = ER_RESETPEER; if (USI->scantype == WINDOW_SCAN ) { @@ -4113,6 +4109,10 @@ static bool get_pcap_result(UltraScanInfo *USI, struct timeval *stime) { } else if (USI->scantype == ACK_SCAN) { newstate = PORT_UNFILTERED; } else newstate = PORT_CLOSED; + } else if (USI->scantype == SYN_SCAN && (tcp->th_flags & TH_SYN)) { + /* A SYN from a TCP Split Handshake - http://nmap.org/misc/split-handshake.pdf - open port */ + newstate = PORT_OPEN; + current_reason = ER_SYN; } else { if (o.debugging) error("Received scan response with unexpected TCP flags: %d", tcp->th_flags);