Nmap for Beginners – Network & Port Scanning made easy

January 6, 2008 at 4:14 pm | Posted in Uncategorized | Leave a comment

Nmap is a very powerful tool with LOTS of options and features to visualize your network. Check which services are running on various hosts and find suspicious malicious programs running in your network. Even though Nmap is the swiss-army knife for network scanning, most of its benefits can be gained by the average Network Administrator without diving deep in to its complications. Chances are, most of the time you will find yourself using common switches even if you know all of them.

The basic syntax for Nmap is ; nmap <IP ADD> , for eg:

nmap 202.21.192.1

the above command scans the given host with defaults – standard TCP connect method (-sT option) and known ports (those specified in the /etc/services file. You may need to scan a whole subnet, in which case you can use:

nmap 202.21.192.1/24
nmap 202.21.192.*

both the command would do the same here.

One of the simplest scan methods that I come up with almost every day is the Ping Scan:

nmap -sP 202.21.192.1
Starting Nmap 4.03 ( http://www.insecure.org/nmap/ ) at 2008-01-04 18:13 MVT
Host 192.168.0.3 appears to be up.
MAC Address: 00:B0:D0:D1:DD:97 (Dell Computer)

the -sP option simply pings the host and reports back whether the host is up or down. Run in the local network, it gives you some additional detail such as MAC Address and the Company for which the NIC card is registered. It is also possible to ping sweep your entire network by specifying a network address and the bitmask.

Stealth Scanning might come in handy too (-sS):

nmap -sS 202.21.192.1

Starting Nmap 4.03 ( http://www.insecure.org/nmap/ ) at 2008-01-04 18:19 MVT
Interesting ports on linuxbox (202.21.192.1):
(The 1671 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
111/tcp open rpcbind


Nmap finished: 1 IP address (1 host up) scanned in 0.156 seconds

The -sT method (default) makes a full connection to that port to see whether the port is open. But in a stealth scan a SYN packet is sent to the host and waits until a SYN from the target host is received to see whether the port is open or closed. In other words does not make a full connection, which reduces the chance of being seen on a target log file.

Scan specific ports and port ranges (-p) :

nmap -sS 202.21.192.1 -p 22,80,50-500

the above command scans the target host for ports 25, 80 and the range between 50 and 500.

OS detection (-O):

nmap -sS 202.21.192.1 -O

the -O option displays the Operating System and its version running on target system. This may not be accurate and may sometimes fail to identify the target OS. But most of the time you’ll end up being lucky…trust me…!

Detect the version of running services (-sV):

nmap -sV 202.21.192.1 -p 25

Starting Nmap 4.03 ( http://www.insecure.org/nmap/ ) at 2008-01-04 18:56 MVT
Interesting ports on linuxbox (202.21.192.1):
PORT STATE SERVICE VERSION
25/tcp open smtp Sendmail 8.13.7/8.13.7
Service Info: Host: linuxbox; OS: Unix

Nmap finished: 1 IP address (1 host up) scanned in 0.070 seconds

It is clear from above that the target system is running sendmail 8.13.7 for its SMTP engine and that the target system is a UNIX based system.

You may also use the -A switch to request Nmap to check for OS version as well as Services version which is easier. There are many other options such as -D (decoy), -sU (UDP scan), etc; not specified in this tutorial that might be useful to you. Please check the nmap documentation and evolve you knowledge on Nmap.

Advertisements

Leave a Comment »

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Create a free website or blog at WordPress.com.
Entries and comments feeds.

%d bloggers like this: