Netcraft’s tests include comprehensive TCP and UDP port scans, and tests for large numbers of well known vulnerabilities which will trigger a reactive IDS, IPS or firewall system.
If Netcraft’s scans are blocked by reactive firewalls we will be unable to give you accurate scan results. While this may be great for demonstrating that your firewall system works correctly we strongly recommend ensuring that our scanners are not blocked as this will help ensure our scan results are as good as possible. Please keep in mind that you should not provide us with access to any systems or services which would not usually be visible to the internet. Blocking access to such services using firewalls is expected and encouraged.
Note that systems which only block attack traffic, rather than all traffic once an attack has been detected are acceptable as they will allow scanning to proceed. Similarly, any IDS which performs logging, or standard static firewalls which block ports that should not be internet accessible are perfectly acceptable, although you may wish to ensure that our scanners are whitelisted in any systems which are likely to send alerts to your staff!
PCI scans which are subject to blocking or other scan interference may be considered ‘inconclusive’. Please see the PCI ASV program guide for full details.
If we believe that our scans are being blocked, we will let you know. We will also notify you of the IP address ranges we conduct our tests from in order to allow you to make any configuration changes.