Network Probes Explained: Understanding Port Scans and Ping Sweeps
Port scans and ping sweeps are just two of many types of network probes. Current network-probing tools have matured significantly. Their continued development and availability means that system administrators will see more interesting probe patterns in the future.
To examine some of these other network probes, let's go back to Nmap. Nmap is able to perform decoy scans. When such a scan occurs, you'll see scans from unique IP addresses on your system, but you won't be able to pick out which one is the real IP address that scanned you. The point of this is to confuse the system administrator, of course.
Besides decoy scans, Nmap also has the ability to remotely identify the operating system running on the target machines. This is done using a technique called TCP/IP stack fingerprinting. We have already seen this in Listing 2, where Nmap correctly identified my target machine as running Linux 2.1.122 - 2.2.14 (my machine was actually running 2.2.12). At the time of writing, the current version of Nmap (2.53) is capable of identifying 465 different versions of operating systems, routers and other devices. Such ability is useful for the intruder because it enables the intruder to identify the weaknesses on a machine since security holes are usually operating system-specific.
If you're interested in other kinds of probe patterns, I highly recommend that you read Stephen Northcutt's book (see Resources). Fyodor's articles on port scanning and TCP/IP stack fingerprinting in Phrack magazine are also interesting.
I hope that this article has been useful to you in understanding two common network probes and how they can be detected. However, security, as always, is an ongoing process. Network probes are going to increase, new security holes are going to be discovered and you'll definitely read about these things in the news almost every day. It pays to be up-to-date. For that reason, I recommend that you subscribe to a security mailing list (BUGTRAQ is highly recommended!) or visit newsgroups and security-related web sites frequently.
|PasswordPing Ltd.'s Exposed Password and Credentials API Service||Apr 28, 2017|
|Graph Any Data with Cacti!||Apr 27, 2017|
|Be Kind, Buffer!||Apr 26, 2017|
|Preparing Data for Machine Learning||Apr 25, 2017|
|openHAB||Apr 24, 2017|
|Omesh Tickoo and Ravi Iyer's Making Sense of Sensors (Apress)||Apr 21, 2017|
- Graph Any Data with Cacti!
- Teradici's Cloud Access Platform: "Plug & Play" Cloud for the Enterprise
- The Weather Outside Is Frightful (Or Is It?)
- Simple Server Hardening
- Understanding Firewalld in Multi-Zone Configurations
- A Switch for Your RPi
- Server Technology's HDOT Alt-Phase Switched POPS PDU
- Gordon H. Williams' Making Things Smart (Maker Media, Inc.)
- Nventify's Imagizer Cloud Engine