RE: Simple Scan

From: Burton Strauss (BStrauss3_at_comcast.net)
Date: 02/18/05

  • Next message: Ariel Doucette: "RE: New to this: How to map network?" 
    To: <security-basics@securityfocus.com>
Date: Fri, 18 Feb 2005 07:10:38 -0600

    ping (icmp protocol) != information about a particular port.

    The icmp protocol operates at a higher level than a specific tcp or udp
    port. Think of ICMP as a scooter, udp as a sports car and tcp as a SUV.
    They all get information to/from places but payloads and overheads are
    different. Just because a scooter gets somewhere doesn't mean that there is
    a parking spot for an SUV.

    To probe something that specific, you need to craft some code that attempts
    to connect - using the right protocol (tcp or udp) and the right parking
    space (port). Luckily there are many tools that already do this - perhaps
    the easiest to come by across a wide range of platforms is nmap
    (http://www.insecure.org/nmap/)

    Read the nmap man page - it has lots of choices, but these probably will be
    what you want:

           -PT [portlist]
                  Use TCP "ping" to determine what hosts are up. Instead of
    sending ICMP echo request packets and waiting for a
                  response, we spew out TCP ACK packets throughout the
    target network (or to a single machine) and then wait for
                  responses to trickle back. Hosts that are up should respond
    with a RST. This option preserves the efficiency of
                  only scanning hosts that are up while still allowing you to
    scan networks/hosts that block ping packets. For non
                  root users, we use connect(). To set the destination ports of
    the probe packets use -PT<port1>[,port2][...]. The
                  default port is 80, since this port is often not filtered
    out. Note that this option now accepts multiple, comma-
                  separated port numbers.

           -PS [portlist]
                  This option uses SYN (connection request) packets instead of
    ACK packets for root users. Hosts that are up should
                  respond with a RST (or, rarely, a SYN|ACK). You can set the
    destination ports in the same manner as -PT above.

           -PU [portlist]
                  This option sends UDP probes to the specified hosts,
    expecting an ICMP port unreachable packet (or possibly a UDP
                  response if the port is open) if the host is up. Since many
    UDP services won't reply to an empty packet, your best
                  bet might be to send this to expected-closed ports rather than
    open ones.

    -----Burton

    -----Original Message-----
    From: Paul Selibas [mailto:gotiex@yahoo.com]
    Sent: Wednesday, February 16, 2005 1:14 AM
    To: security-basics@securityfocus.com
    Subject: Simple Scan

     Greetings all...
      
     I am looking for a way to check which hosts are up and have port 3321 open
    on my network. But i dont want to ping, is there no way of just probing
    port
     3321 and reporting back if it is open or not?
      
     Many Thanks
     

                    
    __________________________________
    Do you Yahoo!?
    Yahoo! Mail - Find what you need with new enhanced search.
    http://info.mail.yahoo.com/mail_250

  • Next message: Ariel Doucette: "RE: New to this: How to map network?"

    Relevant Pages

    • Re: What is going on with my Dialup?
      ... also forward it to an unused port, and have that port provide the ... verses the RST or ICMP 3,3. ... The lack of response causes the remote computer to make ... Others think that by not responding to unwanted packets, ...
      (comp.os.linux.networking)
    • Re: nmap and icmp-replies
      ... Since UDP is stateless, it's the only way a stack can "tell" a port is closed/filtered. ... Even if you send a packet to an open UDP Port, depending on the protocol your scanner has to send a valid payload to get an answer. ... If your target sends ICMP Dest-Unrecheachables, ... You have an option to go with a managed service or an enterprise software. ...
      (Pen-Test)
    • RE: Simple Scan
      ... Your analogy is good, except that ICMP is a layer 3 protocol, TCP & UDP ... ping!= information about a particular port. ...
      (Security-Basics)
    • RE: Interesting packets
      ... ICMP have many types some of them are UDP packets, ... find that ur host x.x.x.4 tried trace route or (some other type of ICMP ...
      (Incidents)
    • Re: pinging without root privileges
      ... > feasible, since I want to be able to do this w/out root privileges, so ... > The closest thing I found was a promise about sending UDP packets to ... > an unbound port, and looking for a port unreachable message. ... > weakness of UDP is that the sender has no way of knowing what happened ...
      (comp.unix.programmer)