diff -urNb nmap-3.95/NmapOps.h nmap-3.95-bad/NmapOps.h
--- nmap-3.95/NmapOps.h	Wed Sep  7 08:26:57 2005
+++ nmap-3.95-bad/NmapOps.h	Wed Dec 21 16:28:17 2005
@@ -279,6 +279,7 @@
   FILE *logfd[LOG_TYPES];
   FILE *nmap_stdout; /* Nmap standard output */
   int ttl; // Time to live
+  int badcrc;
   char *datadir;
  private:
   int max_rtt_timeout;
diff -urNb nmap-3.95/nmap.cc nmap-3.95-bad/nmap.cc
--- nmap-3.95/nmap.cc	Tue Dec  6 22:26:05 2005
+++ nmap-3.95-bad/nmap.cc	Wed Dec 21 16:28:17 2005
@@ -296,6 +296,7 @@
       {"noninteractive", no_argument, 0, 0},
       {"spoof_mac", required_argument, 0, 0},
       {"thc", no_argument, 0, 0},  
+      {"bad", no_argument, 0, 0},  
       {"ttl", required_argument, 0, 0}, /* Time to live */
       {"allports", no_argument, 0, 0},
       {"version_intensity", required_argument, 0, 0},
@@ -472,6 +473,9 @@
       } else if (strcmp(long_options[option_index].name, "thc") == 0) {
 	printf("!!Greets to Van Hauser, Plasmoid, Skyper and the rest of THC!!\n");
 	exit(0);
+      } else if (strcmp(long_options[option_index].name, "bad") == 0) {
+	printf("This option will work with raw sockets only!\n");
+	o.badcrc = 1;
       }
       else if (strcmp(long_options[option_index].name, "iL") == 0) {
 	if (inputfd) {
@@ -1591,6 +1595,7 @@
        "  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans\n"
        "  -sN/sF/sX: TCP Null, FIN, and Xmas scans\n"
        "  --scanflags <flags>: Customize TCP scan flags\n"
+       "  --bad: Set a bad checksum to spot broken stacks, such as firewalls\n"
        "  -sI <zombie host[:probeport]>: Idlescan\n"
        "  -sO: IP protocol scan\n"
        "  -b <ftp relay host>: FTP bounce scan\n"
diff -urNb nmap-3.95/tcpip.cc nmap-3.95-bad/tcpip.cc
--- nmap-3.95/tcpip.cc	Mon Nov 28 01:34:09 2005
+++ nmap-3.95-bad/tcpip.cc	Wed Dec 21 16:31:18 2005
@@ -728,6 +728,22 @@
 u16 oddbyte;
 register u16 answer;
 
+
+/*
+ * We create a random checksum from scratch.
+ * It should be broken (65535/65536)
+ */
+
+if ( o.badcrc == 1 )
+{
+  if ( o.debugging )
+    printf("Bad CRC created...\n");
+
+  answer = rand()%65535;
+  return answer;
+}
+
+
 /*
  * Our algorithm is simple, using a 32-bit accumulator (sum),
  * we add sequential 16-bit words to it, and at the end, fold back