Network Probes Explained: Understanding Port Scans and Ping Sweeps

Network probes are important clues in detecting intrusions. In this article, Lawrence Teo explains two common network probes and what can be done to detect them.
Other Network Probe Features

Port scans and ping sweeps are just two of many types of network probes. Current network-probing tools have matured significantly. Their continued development and availability means that system administrators will see more interesting probe patterns in the future.

To examine some of these other network probes, let's go back to Nmap. Nmap is able to perform decoy scans. When such a scan occurs, you'll see scans from unique IP addresses on your system, but you won't be able to pick out which one is the real IP address that scanned you. The point of this is to confuse the system administrator, of course.

Besides decoy scans, Nmap also has the ability to remotely identify the operating system running on the target machines. This is done using a technique called TCP/IP stack fingerprinting. We have already seen this in Listing 2, where Nmap correctly identified my target machine as running Linux 2.1.122 - 2.2.14 (my machine was actually running 2.2.12). At the time of writing, the current version of Nmap (2.53) is capable of identifying 465 different versions of operating systems, routers and other devices. Such ability is useful for the intruder because it enables the intruder to identify the weaknesses on a machine since security holes are usually operating system-specific.

If you're interested in other kinds of probe patterns, I highly recommend that you read Stephen Northcutt's book (see Resources). Fyodor's articles on port scanning and TCP/IP stack fingerprinting in Phrack magazine are also interesting.

An Ongoing Process

I hope that this article has been useful to you in understanding two common network probes and how they can be detected. However, security, as always, is an ongoing process. Network probes are going to increase, new security holes are going to be discovered and you'll definitely read about these things in the news almost every day. It pays to be up-to-date. For that reason, I recommend that you subscribe to a security mailing list (BUGTRAQ is highly recommended!) or visit newsgroups and security-related web sites frequently.

Resources

Lawrence Teo (lawrenceteo@usa.net) is currently researching distributed intrusion detection techniques for his Honors degree at Monash University in Melbourne, Australia. When he's not working on his thesis or tinkering with UNIX boxes, he can be found wandering around Melbourne in search of good Japanese restaurants.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Ping and Port Scanner

James L's picture

Are this an impact for a company ping sweeps and port scanners

syntax to use ping sweeping...

themanish's picture

syntax to use ping sweeping...??????????

fping -g 192.168.1.0/24

Bfons's picture

fping -g 192.168.1.0/24

Re: Network Probes Explained: Understanding Port Scans and Ping

Anonymous's picture

Question; What are the chances and how could it be done, of some outside agency collecting i/p addresses from active devices on a goverment LAN that has a system alraedy in places to monitor their own performance using a simple pingsweep mechanism themselves???

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState