Discovering stateful firewalls by using a TCP ACK scan