Loading courses...
Please wait while we prepare your learning journey.
Please wait while we prepare your learning journey.
Duration: 2 hours (Estimated)
Welcome to the third episode of our comprehensive Nmap course! In this module, we'll focus on port scanning - the core functionality that made Nmap famous. You'll learn various scanning techniques, understand how to interpret different port states, and develop strategies for effective scanning in different environments.
Port scanning is like checking all the doors and windows of a building to see which ones are open, locked, or alarmed. By mastering these techniques, you'll be able to create detailed maps of network services that reveal potential entry points and security weaknesses that others might miss.
Port scanning is typically part of a larger security assessment workflow:
In this episode, we'll focus on step 3, but understanding how it fits into the broader process is crucial for effective security assessment.
Port scanning is the process of connecting to TCP and UDP ports on a target system to determine what services are running and accessible. It's the foundation of network security assessment, answering the critical question: "What services are exposed on this network?"
Common services include HTTP (80), HTTPS (443), SSH (22), FTP (21), SMTP (25), DNS (53), and many others.
When Nmap scans a port, it classifies it into one of six states:
Understanding these states is crucial for accurate interpretation of scan results.
Nmap uses this decision-making process to determine port states:
Send probe
|
+---> Response received? --No--> Filtered or Open|Filtered
| |
| Yes
| |
+---> SYN-ACK received? --Yes--> Open
|
No
|
+---> RST received? --Yes--> Closed
|
No
|
+---> ICMP unreachable? --Yes--> Filtered
|
No
|
+---> Unfiltered or Closed|FilteredDifferent scan types may follow slightly different logic paths.
To understand port scanning, we need to understand how TCP/IP connections work:
Different scan types manipulate this process in various ways:
Unlike TCP, UDP has no handshake process:
TCP Scanning:
UDP Scanning:
The port scanning techniques learned in this episode are fundamental to many cybersecurity tasks:
Identifying open ports and services is a primary step in finding potential vulnerabilities during penetration tests. Understanding different scan types helps bypass defenses.
Regular port scanning helps organizations identify exposed services, unauthorized applications, and configuration weaknesses as part of their vulnerability management program.
Administrators use port scanning to verify firewall rules, ensure only authorized services are running, and maintain an accurate inventory of network services.
During an incident, port scanning can help identify compromised systems, understand the scope of an attack, and verify containment measures.
-sS) is fast and stealthy but requires root privileges.-sT) is reliable and doesn\u2019t need root, but is slower and noisier.-sU) is important but slower and requires careful interpretation due to UDP\u2019s connectionless nature.In the next episode, we will delve deeper into more advanced scanning techniques:
Watch the video demonstration to see these port scanning techniques in action.
1. What is the primary goal of port scanning?
2. Which Nmap scan type is often called \"stealth scan\" because it doesn\u2019t complete the TCP three-way handshake?
3. If an Nmap scan reports a port state as \"filtered\", what does this typically indicate?
4. Why is UDP scanning generally slower and less reliable than TCP scanning?
5. Which basic Nmap scan type does NOT require root or administrator privileges to run?