RE: Scanning Class A network

From: Derick Anderson (danderson_at_vikus.com)
Date: 10/24/05

  • Next message: Matt Bellizzi: "Re: Scanning Class A network" 
    Date: Mon, 24 Oct 2005 14:56:13 -0400
To: <tarunthenut@gmail.com>, <pen-test@securityfocus.com>

     

    > -----Original Message-----
    > From: tarunthenut@gmail.com [mailto:tarunthenut@gmail.com]
    > Sent: Monday, October 24, 2005 8:33 AM
    > To: pen-test@securityfocus.com
    > Subject: Scanning Class A network
    >
    > Hello All,
    > Recently I was given a task to carry out a port scan of an
    > entire valid Class A range (Dont ask me what the huge pool of
    > valid IP's was for :) ).
    > The scan needed to be carried out externally, and not from
    > within the network to identify hosts and ports exposed to the
    > Internet.
    > The problem compounded cause of the following limitations :
    > 1. ICMP was not allowed in the network
    > 2. The IP range was to be scanned every month for the entire
    > port range fro= m
    > 1-65535 for TCP & UDP
    > After searching for a suitable scanner which could scan such
    > a large range in reasonable time, I could think of only nmap,
    > nessus, superscan and ISS.
    > But because of the limitations stated above,all the tools
    > took a huge amount of time (ran into month).
    > I have struggled with options within the tools, tried
    > configurable parameters (host time out, parallelism, RTT etc)
    > and divided into smaller class C networks and scanned.but
    > still the scan seems to take ages even if it is Any advise
    > would be welcome :)
    >
    > Cheers
    > tarunthenut
    >

    You have to scan 2,198,989,570,050 ports (16.7 million addresses * 65535
    ports * 2 protocols - 131,070 for the network/broadcast addressess,
    assuming this is a real Class A and not a bunch of Class B or C's), so
    you're looking at nearly 850,000 ports scanned per second (2.2 trillion
    / 30 days / 24 hours / 60 minutes / 60 seconds). Multiply half of that
    by the minimum packet size for TCP and the other half for UDP and you'll
    get your bandwidth requirement. Then you can tell your superiors that
    you've been given an impossible task.

    If you are actually dealing with a bunch of Class C's, then the number
    goes down a bit, but still...

    Derick Anderson

    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    futile against web application hacking. Check your website for vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------

  • Next message: Matt Bellizzi: "Re: Scanning Class A network"

    Relevant Pages

    • RE: Need help from a group of experts. I am not a network expert but I play one on tv.
      ... If I had half a penny for every port scan and "bot" initiated attack, ... The single most important thing when it comes to firewalls and security. ... Restricting POP3 e-mail on your network is a step in a right direction. ... most attacks are coming from owned machines. ...
      (Security-Basics)
    • Re: pre-scanning for vulnerability scans?
      ... If by source, you're refering to the network you are testing from, you ... dictionary file for finding host names. ... full port SYN scan on detected hosts ... Audit your website security with Acunetix Web Vulnerability Scanner: ...
      (Pen-Test)
    • RE: Scanning Class A network
      ... the size of network would suggest a distributed scanner especially ... The website is vendor neutral and lists all products good and bad. ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
      (Pen-Test)
    • Re: Scanning Class A network
      ... > Recently I was given a task to carry out a port scan of an entire valid ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
      (Pen-Test)
    • Scanning Class A network
      ... Recently I was given a task to carry out a port scan of an entire valid ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
      (Pen-Test)