Network Security
Port Scanning and Enumeration
(NMAP)
Port Scanning
Definition: Probing the ports on a remote
machine to gain information


Port – a virtual identifier on a system for a particular
application/protocol
Examples:
ftp: port 21
ssh: port 22
telnet: port 23
http: port 80
Oracle: port 1521
Usefulness


Attacker: which ports are open?
Defender: which ports are potential vulnerabilities?
Specific Uses
Find out if system is up

Ping scanning
Find open/vulnerable ports – what services are
available?

Port scanning
Operating System identification


TCP/IP fingerprinting
Based on packet TTL, packet size, flags set on
SYN/SYN|ACK packets in TCP handshaking
How to use this information
Identify exposed ports/services
Shut down any unneeded services

Famous last words - “I didn’t know X was
running on my system”
Ensure that services that are running do
not have security vulnerabilities
Issues
Possible problems with usage

Options can flood target machine with packets,
potentially affecting it
Ethics

Is it ethical to probe an arbitrary system?
Most say “no”
Identification of probing system

http://www.insecure.org/nmap/idlescan.html
Port Scanning Tools
Unix/Linux




nmap
HPING2
udp_scan
netcat (nc)
Windows



SuperScan4
WinScan
ipEye
nmap
One of many software implementations of
a port scanner
Open source
Available on Windows and Unix
Supports many hardware options,
including some PDAs
Now with GUI front ends


Linux: nmapfe
Windows: nmapwin
http://www.insecure.org
nmap features
Identifies open ports

Options for regular or stealth scanning
Regular scanning – attempt full connection with
port; scanned system knows scan is occurring and
can identify scanner
Stealth scanning – attempt partial connection with
port; scanned system may not know scan is
occurring and may not be able to identify scanner
Attempts to identify operating system

Usually correct, but can be fooled
nmap Output Example
Starting nmap V. 2.54 (www.insecure.org)
Interesting ports on (www.xxx.yyy.zzz)
(The xxxx ports scanned but not shown here are in state:
closed)
Port
State Service
22/tcp
open ssh
47017/tcp open unknown
TCP Sequence Prediction: Class-random positive increments
Difficulty=3980866 (Good luck!)
Remote operating system guess: Linux 2.1.122 – 2.2.16
Nmap run completed - - 1 IP address (1 host up) scanned in
5 seconds
SuperScan4
Nice Windows GUI
Many extra options
Information on ports/services in HTML
report format