How to hide system information from network scanning software

How to hide system information from network scanning software

What are the best ways to hide system information (system name, IP address, and installed software) from network scanning software?

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

The absolute best way to hide your system from the probing eyes of network scanners is to install a properly configured software firewall. If the scanners in question are on a remote network, use a network firewall to also block inbound connections. Once installed, configure those defenses to block all unnecessary traffic from reaching your system. On a typical user workstation, simply set the firewall to "Don't allow exceptions," which will completely conceal it from inbound access attempts. With a server that must allow inbound connections, create firewall rules that limit that traffic to the greatest possible extent.

The easiest way to hide system names and IP addresses from external scanners is to use Network Address Translation (NAT) on your network. NAT devices (usually border firewalls) allow you to use private addresses on your internal network and public addresses on your external one. Unless a NAT rule is specifically enabled, such configuration prevents anyone on the Internet from reaching systems that use private addresses.

When using NAT, it's a matter of best practice to use RFC 1918-reserved private address ranges. These include the 10.0.0.0-10.255.255.255, 172.16.0.0-172.31.255.255, and 192.168.0.0-192.168.255.255 address ranges. These addresses are not routable over the Internet, and they can protect you from firewall mis-configurations.

More information:

This was first published in June 2008