if you send a TCP ACK segment to a known closed port on a firewall but it does not respond with an RST. what do you know about the firewall you are scanning?

If no firewall were present, the target host's TCP stack would send an RST in response to an unexpected ACK on a closed port - the silence indicates active filtering, not the absence of one.

The absence of an RST to a targeted ACK probe is a recognized behavioral signature of stateful inspection firewalls and constitutes meaningful diagnostic information about the device architecture.

A stateful firewall maintains a connection tracking table and only permits packets that correspond to an established or related session. An unsolicited ACK sent to a closed port has no matching SYN-ACK entry in the state table, so the stateful firewall drops the packet silently without generating an RST. If the endpoint were unfiltered or behind a stateless device, the host TCP stack would reply with an RST to the unexpected ACK on a closed port.

A stateless firewall processes each packet independently without connection tracking, so it would not suppress the RST that a closed port would otherwise generate.