title: Bug with nmap on port 80
body: <p>First, Thank you for taking the time to read this :).</p>
  
  <p>I'm working in a company where I'm developping an automated port scanning tool, basically, it scans everyday some ports of the public IPs of my company and send an email if there is something strange.</p>
  
  <p><strong>Command Line:</strong></p>
  
  <pre><code>nmap -p1-1024 -sS host
  </code></pre>
  
  <p><strong>Problem:</strong>
  I'm currently facing a very strange problem, when i'm scanning my company's ips which have port 80 open, as soon as nmap scan port 80 (i.e. nmap send a SYN then receive a SYN - ACK because port 80 is open), it loops on it until the end of the scan. I mean, nmap will scan all other ports as usual but won't stop to send SYN to port 80 until the scan is over. In tcpdump we clearly see that we receive the SYN - ACK from the server. More over, nmap show the port open at the end of the scan.</p>
  
  <p><strong>Network:</strong>
  I am doing the scan from an external internet connection, so when I send a SYN to the server, it goes on the F5 Load Balancer of my company, then on a Cisco ASA Firewall and then on the server.</p>
  
  <p><strong>What I did:</strong></p>
  
  <ul>
  <li>Looked at other ports to see if it is only for port 80, and yes, it is only on port 80, for exemple with port 443 open nmap just do a SYN, then receive a SYN - ACK and stop send SYN to port 443.</li>
  <li>Checked with a TCP Connect scan instead of a TCP SYN scan, same problem.</li>
  <li>Tried to scan the private IP of the server from the internal network of my company, no problem, nmap stop sending SYN once he received the first SYN - ACK.</li>
  <li>Checked another server (my private server and scanme.nmap.org) and there is no problem on port 80, nmap stop once he received SYN - ACK.</li>
  </ul>
  
  <p>So, it seems like the F5 is modifying the TCP SYN - ACK packet but why is Nmap still checking for this port even if he receive a SYN - ACK response?</p>
  
  <p>Thank you.</p>