Introduction to Port Scanners

Port scanners are often used by administrators to check the security policies or by attackers to identify running services on a host. Port scanning is used to send packets to a list of port numbers in order to:

  • Check for live systems
  • Identify open ports on a system
  • Learn about services available on a system
  • Version detection of running services
  • OS detection
There are a few available port scanners:
  • Nmap
  • Netscan Pro Tools
  • Solarwinds Engineers Toolset
  • Superscan
  • Netifera
  • Unicornscan
Nmap
  • The most popular port scanner
  • A lot of features
  • Open source
  • Multiplatform (Windows, Linux, BSD, OS X)
  • Command line and GUI
  • Available at  http://nmap.org/
Nmap Common Options
  • – h  help
  • -p  choose ports
  • -sS    TCP SYN Scan
  • -sT  TCP Connect Scan
  • -sU  UDP Port Scan
  • -v  verbose output
  • -O  OS detection
  • -sV    Service version detection
  • -f  fragment packets
Scanning Countermeasures
  • Configure firewalls and Intrusion Detection Systems to detect and block probes
  • Filter inbound ICMP messages
  • Filter outbound ICMP type 3 unreachable messages at boarder routers and firewalls
  • Evaluate the way that firewall and IDS handle fragmented packets by performing scanning exercises using fragtest and fragroute
  • Configure Internet firewalls to identify port scans and block the connection

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.