# NMAP ruleset are FP?

**URL:** <https://community.emergingthreats.net/t/nmap-ruleset-are-fp/1945>\
**Category:** Rule Signatures\
**Tags:** etopen, false-positives\
**Created:** [September 5, 2024, 11:34am UTC](https://community.emergingthreats.net/t/nmap-ruleset-are-fp/1945 "2024-09-05T11:34:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jul10l1r43](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jul10l1r43/32/1100_2.png) [@jul10l1r43](https://community.emergingthreats.net/u/jul10l1r43)\
**Post date:** [September 5, 2024, 11:34am UTC](https://community.emergingthreats.net/t/nmap-ruleset-are-fp/1945/1 "2024-09-05T11:34:22Z")

</div>

Does anyone know why several rules that identified portscan were removed? 2009582 for example

```auto
# alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN NMAP -sS window 1024"; fragbits:!D; dsize:0; flags:S,12; ack:0; window:1024; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2009582; classtype:attempted-recon; sid:2009582; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

```

---

<div class="post-metadata">

**Author:** ![James](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@James](https://community.emergingthreats.net/u/James)\
**Post date:** [September 5, 2024, 12:59pm UTC](https://community.emergingthreats.net/t/nmap-ruleset-are-fp/1945/2 "2024-09-05T12:59:33Z")

</div>

Hey, the rule you referenced has not been removed or deleted, it is simply disabled. This was one of many rules that we have chosen to disable by default to improve the performance of the default ruleset before any curations are made.