Port Scanning
Dive into the world of port scanning: Explore techniques, tools, and Visualization simulations.
Intronetwork
What is Port Scanning?
Port scanning is a method for determining which ports on a network are open and could be receiving or sending data. It is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it.
Types of Port Scans
- TCP Connect Scan
- Attempts to complete a full TCP three-way handshake (SYN - SYN ACK - ACK) with each port.
- SYN Scan
- Sends a SYN packet and analyzes the response without completing the handshake. Same as TCP but without the final ACK packet.
- UDP Scan
- Sends UDP packets to identify open UDP ports. If the port is close ICMP Destination Unreachable (Type 3, Code 3) response indicating that the port is closed. If the port is open, no response (no ICMP error) or the service processes the request and replies
- FIN Scan
- Sends a FIN packet to elicit a response from closed ports. If the port is open, the packet is ignored and no response is sent. If the port is closed, the system will respond with an RST packet.
- XMAS Scan
- Sends packets with FIN, URG, and PUSH flags set. If the port is open, the system will ignore the packet and not respond. If the port is closed, the system will respond with an RST packet.
Port Scan Visualization
Port Scan
Port Open
Port Closed
21
FTP
22
SSH
23
Telnet
25
SMTP
53
DNS
80
HTTP
110
POP3
143
IMAP
443
HTTPS
3389
RDP
Port Scanning Tools and Commands
Nmap
Scan all ports on the specified IP address
nmap -p- 192.168.1.1Nmap (SYN Scan)
Perform a SYN scan on the default 1000 ports
nmap -sS 192.168.1.1Nmap (UDP Scan)
Perform a UDP scan on specified ports
nmap -sU -p 123,161,500 192.168.1.1Nmap (Service Version)
Attempt to determine service/version info for open ports
nmap -sV 192.168.1.1Netcat
Scan ports 1-1000 on the specified IP address
nc -zv 192.168.1.1 1-1000