Re: Scanning hosts behind a NAT

Hi list ;),
I'm a student and I'm trying to learn how nmap does its job.
Today, for example, I tried to scan my home network ( ;) )... In fact,
I've 2 computers behind a router (which does wireless AP, router &
firewall: linksys wrt54g). Then, I tried to scan from "outside" the
network (aka: from a friend on the internet).
On the router (LAN ip: 192.168.1.1) , I've the port 6356 (Gnutella)
which is forwarded to 192.168.1.2 (my first pc).

When I tried to scan from outside, I obviously obtain:

That is what you would get if you just went up to the front door and
started knocking on it and asking what services they are running. A
couple of options you may want to look into are FTP bounce scans, the
various other scans that are avaliable with nmap, such as a SIN/FIN/XMAS
scan. I know that its possible to ping some places and get past the
firewall with various ICMP messages and UDP messages as well. Also look
at the routing options avaliable to nmap. They may give you some help
getting past NAT.

But as the other poster said 99% of properly configured NATing routes will
return only the external IP address, but just becuause some people say its
not possible does not mean it is. Its just harder then a server with a
true public IP. HTH


-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------

Relevant Pages

  • Re: starting point
    ... network of some 100 computers, and would like to start monitoring our web traffic with ethereal... ... Another idea would be to run tcpdump or windump on the web server and have it write to a file. ... See why so many companies trust Spy Sweeper Enterprise to eradicate spyware from their networks. ...
    (Security-Basics)
  • Re: how nmap can know my firewalled servers ?
    ... I know that "nmap" can show open ports. ... Try Webroot's Spy Sweeper Enterprisefor 30 days for FREE with no ... See why so many companies trust Spy Sweeper Enterprise to ... FREE 30-Day Trial of Spy Sweeper Enterprise ...
    (Security-Basics)
  • RE: malware block my PC for to enter in internet, possible?
    ... Try to determine if your PC can communicate on the network. ... Try Webroot's Spy Sweeper Enterprisefor 30 days for FREE with no ... See why so many companies trust Spy Sweeper Enterprise to ... FREE 30-Day Trial of Spy Sweeper Enterprise ...
    (Security-Basics)
  • Re: starting point
    ... Will explain everything there is to see in a standard IPv4 network. ... Try Webroot's Spy Sweeper Enterprisefor 30 days for FREE with no ... FREE 30-Day Trial of Spy Sweeper Enterprise ...
    (Security-Basics)
  • Finding Wireless APs on your network
    ... What would be the best way to locate wireless devices on a remote ... Try Webroot's Spy Sweeper Enterprisefor 30 days for FREE with no ... FREE 30-Day Trial of Spy Sweeper Enterprise ...
    (Security-Basics)