Nmap and the art of port scanning
Summary
In issue 51 of Phrack Magazine of 1 September 1997, Fyodor published the article “The Art of Port Scanning” and appended the source code of a new scanner: Nmap. The text explains techniques such as the TCP SYN scan, FIN scans, UDP scans and scanning with fragmented packets to get past packet filters. What began as an appendix in a hacker magazine became one of the most important tools for network administrators and security testers.
What the article explains
Fyodor explains why a port scan is more than making a connection: the simple connect() scan shows up in every log, the SYN scan only sends the first packet of the handshake and aborts after the reply, and FIN scans exploit the fact that closed ports react differently to unexpected packets than open ones. Add UDP scans using ICMP error messages, ping sweeps, scans bounced through an FTP server and queries to the ident service.
Right at the start there is a jab at the media’s image of the internet: the net does not consist only of TCP port 80, and anyone who knows only the web knows as much as an average AOL user. Nmap was meant to solve the problems of other scanners, especially when scanning large networks.
Ideas
- To defend your network, you have to see it the way an attacker does.
- Different replies to unusual packets reveal a lot about a system.
- An open port is a communication channel, intended or not.
- Free source code turned an article into a tool for everyone.
Insights
- Nmap shows how knowledge from the hacker scene became standard for defenders: today a port scan is part of every inventory and every security audit.
- Many of the tricks described in 1997 still work because they rely on the behaviour of TCP itself rather than on bugs in individual programs.
Facts
- The SYN scan is also called a half-open scan because it never completes the connection.
- In 1997 Nmap supported connect(), SYN, FIN, UDP, ping and FTP bounce scans, among others.
- The source code was appended to the article and freely redistributable.
References
Remarks
- Fyodor is the pseudonym of Gordon Lyon, who still develops Nmap today.
Recommendations
- Only scan your own networks or networks you have written permission for; in Germany, section 202c of the Criminal Code makes even preparing to spy on data a criminal offence.
- Regularly scan your own public addresses and compare the result with the list of intended services.
- Check firewall rules with a SYN and a UDP scan, not just a ping.
Links to the original source and the Web Archive open in a new tab.