Could you not instead of using one nmap process to scan 200+ addresses, just instead initiate 200+ nmap processes scanning just one IP.
Still effectively hits your spoofing system but now they bring their time back down to what it would take to scan a single IP address.
I'm sure there are many other ways around this but like all security it's merely a case of making it difficult enough that an attacker would need serious incentive to make the attack.
Still effectively hits your spoofing system but now they bring their time back down to what it would take to scan a single IP address.
I'm sure there are many other ways around this but like all security it's merely a case of making it difficult enough that an attacker would need serious incentive to make the attack.