Patent ID: 7962957

Claim:
A computer implemented method for port scan protection, the computer implemented method comprising: responsive to detecting a port scan, generating, by a processor, a reply data packet having a modified header conforming to a protocol used to transmit data packets to form a modified reply data packet, wherein the modified reply data packet will elicit a response from a recipient of the modified reply data packet, wherein the modified header will compel the recipient's transmission control protocol/internet protocol layer to respond to the modified reply data packet in response to the recipient snooping the modified reply data packet; sending the modified reply data packet to a first source internet protocol address associated with the port scan; and responsive to receiving the response to the modified reply data packet, identifying that a second source internet protocol address in a header of the response is a correct source internet protocol address of a source of the port scan, wherein the second source internet protocol address is different from the first source internet protocol address.