This is the fifth in a series of tips on how to use Nmap in an enterprise network environment.
In our last tip we looked at the basic Nmap commands for scanning network machines and services.
Nmap's TCP Null (option –sN), FIN (option –sF) and Xmas (option –sX) scans exploit a subtle loophole in the TCP protocol specification as described in RFC 793. When scanning systems compliant with this RFC (such as most Unix-based systems), any packet not containing set SYN, RST or ACK bits will result in a returned RST (reset) packet if the port is closed, and no response at all if the port is open. If a RST packet is received, the port is considered closed, while no response means it is open or possibly filtered. The key advantage to these scans is that they can pass through certain non-stateful firewalls and packet-filtering routers.
Another scan that can bypass packet filters in certain circumstances is the IPID Idle scan (option -sI). By using another device on the network, commonly called a zombie, Nmap's Idlescan can gather port information from a remote device without having to send it a single packet from its own IP address. Any intrusion detection system (IDS) will report the innocent zombie as the attacker but of more importance is that this scan can be used to map out IP-based trust relationships
Nmap provides another scan, the TCP ACK scan (option -sA), to help map out firewall rule sets. This scan doesn't determine whether a port is open or closed, but it can tell if it's filtered and whether the device filtering the port is stateful or not. We will look at firewall evasion in the next tip, but in the meantime, you can experiment probing and analysing your firewalls and network by sending a variety of probe types with different flag settings. Even though Nmap includes several different scans, you can design your own scan by specifying arbitrary TCP flags using the Custom TCP scan (option --scanflags). For example, you can run a SYN|FIN scan with the command
NMAP TECHNICAL MANUAL
Nmap: A valuable open source tool for network security
How to install and configure Nmap for Windows
How to install and configure Nmap on Linux
How to scan ports and services
More port scanning techniques
Firewall configuration testing
Techniques for improving Nmap scan times
Interpreting and acting on Nmap scan results
Nmap parsers and interfaces
Nmap and the open source debate
This was first published in June 2006