Nmap: How to scan ports and services

This is the fourth in a series of tips on how to use Nmap in an enterprise network environment.

Nmap is the ideal tool for performing a simple network inventory or vulnerability assessment. By default, Nmap performs a SYN Scan, which works against any compliant TCP stack, rather than depending on idiosyncrasies of specific platforms. It can be used to quickly scan thousands of ports, and it allows clear, reliable differentiation between ports in open, closed and filtered states.

To perform a SYN scan on the host www.yourorg.com, use the command
nmap www.yourorg.com
Though not essential, it's best if you have root access on your Unix or Linux machine, or use an administrator account on Windows, as most of the scan types send and receive raw packets, and so are only available to privileged users. If you don't have the necessary privileges or you are scanning an IPv6 network, use the command
nmap –sT www.yourorg.com
to perform a TCP connect scan. Nmap scans all ports up to and including 1024, as well as higher numbered ports listed in the nmap-services file. You can also specify the ports you want to scan using –p, so:
nmap –p U:53,T:21-25 www.yourorg.com
will scan just UDP port 53 and TCP ports 21 to 25.

Once you discover a machine's visible ports, you need to know which services are running on them in order to inventory them or determine to which exploits the machine is vulnerable. The –sV option enables version detection interrogation, but a better option is –A which enables both OS detection and version detection. The following uses the nmap-service-probes database to try and determine the service protocol, the application name, the version number, hostname, device type, the OS family, and other miscellaneous details like the SSH protocol version or whether an X server is open to connections:
nmap –A www.yourorg.com
If Nmap is compiled with OpenSSL support, it can even...

Nmap offers various output formats for both human and machine consumption, including XML, which can be imported into a database or parsed by programs such as the Nmap graphical user interface NmapFE. For example, by adding the following options:
-oX and –oN
you can save the regular output for your own review while saving an XML version of the same scan for programmatic analysis, as in
nmap –A –oX scanreport.xml –oN scanreport.txt www.yourorg.com
There are also options for controlling the detail of the output as well as various debugging messages. If a prolonged scan doesn't complete for some reason it can be resumed at the target it was querying when execution stopped, but unfortunately, this feature does not support the XML output format.

In the next Nmap tip we'll be looking at more Nmap scanning techniques, including Idle scans.

[IMAGE]
[IMAGE]NMAP TECHNICAL MANUAL
[IMAGE]
[IMAGE]  Introduction
[IMAGE]  Nmap: A valuable open source tool for network security
[IMAGE]  How to install and configure Nmap for Windows
[IMAGE]  How to install and configure Nmap on Linux
[IMAGE] How to scan ports and services
[IMAGE]  More port scanning techniques
[IMAGE]  Firewall configuration testing
[IMAGE]  Techniques for improving Nmap scan times
[IMAGE]  Interpreting and acting on Nmap scan results
[IMAGE]  Nmap parsers and interfaces
[IMAGE]  Nmap and the open source debate

Rate this Tip To rate tips, you must be a member of SearchSecurity.com. Register now to start rating these tips. Log in if you are already a member. BROWSE BY TAG Network Security Tactics,   Network Intrusion Detection and Analysis,   Enterprise Network Security,   Monitoring Network Traffic and Network Forensics,   VIEW ALL TAGS Digg This!     StumbleUpon     Del.icio.us    RELATED CONTENT Network Security Tactics Screencast: Find rogue wireless acess points with Vistumbler How to prepare for a secure network hardware upgrade Preventing SQL injection attacks: A network admin's perspective Screencast: How to launch an OpenVAS scan Wireless network guidelines for PCI DSS compliance Aligning network security with business priorities Scanning with N-Stalker offers basic Web application security assessment Lifecycle of a network security vulnerability Screencast: BackTrack 4 offers an arsenal of penetration testing tools Network access control technology: Over-hyped or underused? Monitoring Network Traffic and Network Forensics Botnet masters turn to Google, social networks to avoid detection Preventing SQL injection attacks: A network admin's perspective Breach prevention: How to keep track of data and applications Researchers find thousands of flawed embedded devices Network traffic collection, analysis helps prevent data breaches Lifecycle of a network security vulnerability Port scan attack prevention best practices How to prevent network sniffing and eavesdropping DoD urges less network anonymity, more PKI use Chained Exploits: How to prevent phishing attacks from corporate spies RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary bridge  (SearchSecurity.com) computer forensics  (SearchSecurity.com) Einstein  (SearchSecurity.com) footprinting  (SearchSecurity.com) information signature  (SearchSecurity.com) inverse mapping  (SearchSecurity.com) network behavior analysis  (SearchSecurity.com) network forensics  (SearchSecurity.com) promiscuous mode  (SearchSecurity.com) snoop server  (SearchSecurity.com) RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.