Manage Learn to apply best practices and optimize your operations.

Nmap: More port scanning techniques

In this fifth tip in our Nmap manual, expert Michael Cobb looks at some of the Nmap port scanning techniques that exploit certain idiosyncrasies of specific platforms or protocols in order to better differentiate between open and closed ports.

This is the fifth in a series of tips on how to use Nmap in an enterprise network environment.

In our last tip we looked at the basic Nmap commands for scanning network machines and services. In this tip I want to look at some of the scans that exploit certain idiosyncrasies of specific platforms or protocols in order to better differentiate between open and closed ports.

Nmap's TCP Null (option –sN), FIN (option –sF) and Xmas (option –sX) scans exploit a subtle loophole in the TCP protocol specification as described in RFC 793. When scanning systems compliant with this RFC (such as most Unix-based systems), any packet not containing set SYN, RST or ACK bits will result in a returned RST (reset) packet if the port is closed, and no response at all if the port is open. If a RST packet is received, the port is considered closed, while no response means it is open or possibly filtered. The key advantage to these scans is that they can pass through certain non-stateful firewalls and packet-filtering routers.

Another scan that can bypass packet filters in certain circumstances is the IPID Idle scan (option -sI). By using another device on the network, commonly called a zombie, Nmap's Idlescan can gather port information from a remote device without having to send it a single packet from its own IP address. Any intrusion detection system (IDS) will report the innocent zombie as the attacker but of more importance is that this scan can be used to map out IP-based trust relationships between machines, because the Idlescan results show open ports from the zombie machine's perspective. So for example, a normal scan against a database server might show no ports open, but by using a file server IP as the zombie the database-related service ports on the database server may show open and expose a trust relationship. If by using Nmap to explore your network you realize that it's susceptible to IPID-related attacks, then you need to configure or adjust your firewall and router rules to deny incoming packets with bogus source addresses. Also, you should enable egress filtering to prevent spoofed packets from leaving your network to prevent your internal users from launching this type of attack.

Nmap provides another scan, the TCP ACK scan (option -sA), to help map out firewall rule sets. This scan doesn't determine whether a port is open or closed, but it can tell if it's filtered and whether the device filtering the port is stateful or not. We will look at firewall evasion in the next tip, but in the meantime, you can experiment probing and analysing your firewalls and network by sending a variety of probe types with different flag settings. Even though Nmap includes several different scans, you can design your own scan by specifying arbitrary TCP flags using the Custom TCP scan (option --scanflags). For example, you can run a SYN|FIN scan with the command:

nmap –sF –-scanflags SINFIN –p20-25

Nmap technical manual

About the author:
Michael Cobb, CISSP-ISSAP, is a renowned security author with over 20 years of experience in the IT industry. He has a passion for making IT security best practices easier to understand and achievable. His website offers free security posters to raise employee awareness of the importance of safeguarding company and client data and of following good practices. He co-authored the book IIS Security and has written many technical articles for leading IT publications. Mike has also been a Microsoft Certified Database Manager and registered consultant with the CESG Listed Advisor Scheme (CLAS).

Next Steps

Learn how to use port scanning tools to test network security

View a tutorial on using Nmap NSE

Join the discussion: Interpreting and acting on Nmap scan results

This was last published in June 2006

Dig Deeper on Open source security tools and software