RE: Port Scanning.
From: rzaluski (rzaluski_at_ivolution.ca)
To: "'Piskovatskov, Alexey'" <Alexey.Piskovatskov@bindview.com>, "'Faisal Khan'" <email@example.com>, <firstname.lastname@example.org> Date: Mon, 13 Dec 2004 23:53:32 -0500
Port scanning is only part of it. If you are using manual or automated
tools you still need to VERIFY that the port number associated with the
protocol is indeed what it advertises to be. Nmap for instance blindly
Accepts that port 22 is associated with SSH but it this fact? You should
always verify the port protocol to ensure that this is the case.
For instance running nmap output through amap.
- amap interrogates the protocol bound to the number
For instance you can do the following :
Step 1. Scan the target host and produce a machine-readable output file. In
this case it is "nmap.output"
nmap -sS 10.21.1.5 -oM output.nmap
Step 2 use this output file as input for amap.
Amap -I nmap.output
amap -i output.nmap
amap v4.7 (www.thc.org) started at 2004-12-14 00:50:02 - APPLICATION MAP
Protocol on 10.21.1.5:22/tcp matches ssh
Protocol on 10.21.1.5:22/tcp matches ssh-openssh
Protocol on 10.21.1.5:443/tcp matches http
Protocol on 10.21.1.5:443/tcp matches http-apache-2
Protocol on 10.21.1.5:80/tcp matches http
Protocol on 10.21.1.5:25/tcp matches smtp
Protocol on 10.21.1.5:80/tcp matches http-apache-2
.... you get the idea
As you can see amap also found that we are running an apache server ;-)
amap is a good tool that can be downloaded from
CISO, Security and Infrastructure Services
iVolution Technologies Incorporated
From: Piskovatskov, Alexey [mailto:Alexey.Piskovatskov@bindview.com]
Sent: Monday, December 13, 2004 11:24 AM
To: Faisal Khan; email@example.com
Subject: RE: Port Scanning.
There's good document by NIST on this subject:
Because nature of the scanners to report false positives/negatives,
using multiple vendors and/or free tools is appropriate.
From: Faisal Khan [mailto:firstname.lastname@example.org]
Sent: Monday, December 13, 2004 8:47 AM
Subject: Port Scanning.
What's a good industry practise whilst doing port-scanning during a
Do you rely on the results of a single vendor's software or do you use
Also, with each OEM/vendor - do you scan once or twice?
I need to do a scan on a Class C Address if that matters in any way.
Faisal Khan, CEO
Net Access Communication
Systems (Private) Limited
Network Security - Secure Web Hosting
Managed Internet Services - Secure Email
Dedicated Servers - Reseller Hosting
Visit www.netxs.com.pk for more information.