Cisco Cisco Firepower Management Center 4000

Scan Which 
Address(es) From 
Event? 

When you use an Nmap scan as a response to a correlation rule, select an 
option to control which address in the event is scanned, that of the source 
host, the destination host, or both.

N/A

Scan Types

Select how Nmap scans ports: 

The 

scan connects quickly to thousand of ports without using a 

complete TCP handshake. This options allows you to scan quickly in 
stealth mode on hosts where the 

admin

 account has raw packet access 

or where IPv6 is not running, by initiating TCP connections but not 
completing them. If a host acknowledges the Syn packet sent in a TCP 
Syn scan, Nmap resets the connection. 

The 

 scan uses the 

connect()

 system call to open 

connections through the operating system on the host. You can use the 
TCP Connect scan if the 

admin

 user on your Defense Center or 

managed device does not have raw packet privileges on a host or you 
are scanning IPv6 networks. In other words, use this option in 
situations where the TCP Syn scan cannot be used. 

The 

 scan sends an ACK packet to check whether ports are 

filtered or unfiltered.

The 

 scan works in the same way as a TCP ACK scan but 

can also determine whether a port is open or closed.

The 

 scan identifies BSD-derived systems using a FIN/ACK 

probe.

: 

-sS

: 

-sT

: 

-sA

: 

-sW

: 

-sM

Scan for UDP ports

Enable to scan UDP ports in addition to TCP ports. Note that scanning UDP 
ports may be time-consuming, so avoid using this option if you want to scan 
quickly.

-sU

Use Port From Event 

If you plan to use the remediation as a response in a correlation policy, 
enable to cause the remediation to scan only the port specified in the event 
that triggers the correlation response. 

You can also control whether Nmap collects information about 
operating system and server information. Enable the 

 option to scan the port associated with the new server.

N/A

Scan from reporting 
detection engine

Enable to scan a host from the appliance where the detection engine that 
reported the host resides.

N/A

Fast Port Scan

Enable to scan only the TCP ports listed in the 

nmap-services

 file located 

in the 

/var/sf/nmap/share/nmap/nmap-services

 directory on the device 

that does the scanning, ignoring other port settings. Note that you cannot 
use this option with the 

 option.

-F

Port Ranges and Scan 
Order

Set the specific ports you want to scan, using Nmap port specification 
syntax, and the order you want to scan them. Note that you cannot use this 
option with the 

 option.

-p