Make OS detection avoid ports with likely interference by middleboxes

[dmiller-nmap]

Nmap's OS detection sends probes and looks at responses, but only tests 2 TCP ports per host: one open and one closed. If a middlebox (IPS, firewall, etc.) is interfering with traffic on some ports and we choose one of those, the fingerprint will be bad and OS detection will likely fail. We should therefore try to choose the best, most accurate ports that result in direct communication with the target.

Nmap already has code to avoid some ports based on service detection as "tcpwrapped" (which is sometimes evidence of interference). This could be extended to support other criteria such as:

• Avoid TCP ports 25, 113, 445, and others which are frequently intercepted by ISPs.
• TTL analysis: If one port's reason_ttl is one or two higher than others, it is probably interference. This would be harder to detect if the target has more interference ports than real ones, or if the middlebox uses a different initial TTL. Also, be aware that some OSs use different initial TTLs for open vs closed TCP and for TCP vs UDP/ICMP.