What scanners actually learn
Reconnaissance tools such as Nmap send probes—ICMP echo, TCP SYN segments, UDP datagrams—and classify responses as open, closed, or filtered. Anything that answers uniquely (including ICMP errors) becomes signal. The goal of hardening is not theatrical invisibility; it is to shrink unnecessary answers, move sensitive workloads behind policy enforcement, and ensure authorized internal discovery still works for your own operations team.
ICMP and “WAN ping” toggles
Dropping inbound echo-request at the edge removes an easy liveness check for script kiddies, but it does not stop TCP connect scans and may complicate legitimate monitoring. Document the change; many carriers still need ICMP for path MTU discovery. Host-level firewalls can ignore echo while preserving other ICMP types where required.
Segmentation and IoT
Consumer routers implement guest SSIDs as VLANs or isolated subnets—use them for cameras, voice assistants, and guests so a compromised gadget cannot ARP-scan your workstations. In offices, pair wireless segmentation with 802.1X and NAC so only enrolled devices receive addressability on trusted VLANs. See IoT IP security practices for camera and NVR placement.
Cloud and IPv6 notes
Default-allow security groups are a larger issue than ICMP replies: enumerate listeners with periodic authorized scans, then default deny everything else. IPv6 exposes hosts to global reachability unless ingress filters mirror IPv4 discipline—neighbor discovery and SLAAC do not magically inherit IPv4 NAT obscurity.
TCP backlog, SYN-RECEIVED, and kernel queues
Half-open connections sit in SYN-RECEIVED until completed or timed out. Linux exposes counts via ss -s and /proc/net/netstat. Alongside tcp_syncookies, sizing net.core.somaxconn and application listen() backlogs affects how many fully-established sockets can queue—not the same counter as SYN cookies, but overloaded servers need both tuned.
RFC 4987 documents TCP SYN flooding mitigation considerations for implementers. At the edge, stateless SYN proxies and carrier scrubbers absorb spoofed floods before they hit your NIC ring buffer. Pair host controls with authorized scanning in staging to validate timeouts under load.
After tightening rules, validate what the Internet still sees from your public address using your public IP context plus fresh external scans from an approved jump host.