Scribd Logo
Upload

Welcome to Scribd!

  • 106 views

    3 Nmap

    Uploaded by

    John Wick
    Nmap is a free and open-source tool used for network scanning and security auditing. It identifies hosts on a network, enumerates open ports, determines operating systems and versions of network services. Nmap features include host discovery, port scanning, version detection, OS detection and scriptable interaction with targets. It allows spoofing IP addresses with decoys to simulate many devices during scans and test intrusion detection systems. The document provides the syntax and commands for using Nmap to perform various port scans and network analysis.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    3 Nmap

    Uploaded by

    John Wick
    106 views6 pages
    Nmap is a free and open-source tool used for network scanning and security auditing. It identifies hosts on a network, enumerates open ports, determines operating systems and versions of network services. Nmap features include host discovery, port scanning, version detection, OS detection and scriptable interaction with targets. It allows spoofing IP addresses with decoys to simulate many devices during scans and test intrusion detection systems. The document provides the syntax and commands for using Nmap to perform various port scans and network analysis.

    Original Description:

    Nmap Experiment

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Nmap is a free and open-source tool used for network scanning and security auditing. It identifies hosts on a network, enumerates open ports, determines operating systems and versions of network services. Nmap features include host discovery, port scanning, version detection, OS detection and scriptable interaction with targets. It allows spoofing IP addresses with decoys to simulate many devices during scans and test intrusion detection systems. The document provides the syntax and commands for using Nmap to perform various port scans and network analysis.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    106 views6 pages

    3 Nmap

    Uploaded by

    John Wick
    Nmap is a free and open-source tool used for network scanning and security auditing. It identifies hosts on a network, enumerates open ports, determines operating systems and versions of network services. Nmap features include host discovery, port scanning, version detection, OS detection and scriptable interaction with targets. It allows spoofing IP addresses with decoys to simulate many devices during scans and test intrusion detection systems. The document provides the syntax and commands for using Nmap to perform various port scans and network analysis.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 6

    Experiment no 2: Packet sniffer tools

    Aim of experiment : Download and install nmap. Use it with different options to scan open
    ports, perform OS fingerprinting, do a ping scan, tcp port scan, udp port scan, etc.
    Objective of experiment: Objective of this module to learn nmap installation & use this to scan
    different ports.
    Scope : Used for ip spoofing and port scanning.
    Technology: Networking

    Theory:
    Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and
    security auditing. Many systems and network administrators also find it useful for tasks such as
    network inventory, managing service upgrade schedules, and monitoring host or service uptime.
    Nmap uses raw IP packets in novel ways to determine what hosts are available on the network,
    what services (application name and version) those hosts are offering, what operating systems
    (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of
    other characteristics. It was designed to rapidly scan large networks, but works fine against
    single hosts. Nmap runs on all major computer operating systems, and official binary packages
    are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap
    executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible
    data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff),
    and a packet generation and response analysis tool (Nping).
    Nmap features include:

    Host discovery Identifying hosts on a network. For example, listing the hosts that
    respond to TCP and/or ICMP requests or have a particular port open.

    Port scanning Enumerating the open ports on target hosts.

    Version detection Interrogating network services on remote devices to determine


    application name and version number.[6]

    OS detection Determining the operating system and hardware characteristics of


    network devices.

    Scriptable interaction with the target using Nmap Scripting Engine (NSE) and Lua
    programming language

    Syntax:

    nmap [ <options> ] [ <results file> ]


    Options Summary
    -f, --file <results file>
    Open the given results file for viewing. The results file may be an Nmap XML output file
    (.xml, as produced by nmap -oX), or a file previously saved by Zenmap.
    -h, --help
    Show a help message and exit.
    --confdir<dir>
    Use <dir> as the per-user configuration directory.
    -n, --nmap<Nmap command line>
    Run the given Nmap command within the Zenmap interface. After -n or --nmap, every
    remaining command line argument is read as the command line to execute. This means
    that -n or --nmapmust be given last, after any other options. Note that the command line
    must include the nmap executable name: zenmap -n nmap -sS target.
    -p, --profile <profile>
    Start with the given profile selected. The profile name is just a string: "Regular scan". If
    combined with -t, begin a scan with the given profile against the specified target.
    -t, --target <target>
    Start with the given target. If combined with -p, begin a scan with the given profile
    against the specified target.
    -v, --verbose
    Increase verbosity (of Zenmap, not Nmap). This option may be given multiple times for even
    more verbosity printed to the console window used to start Zenmap.
    nmap Decoys:
    Syntax:
    Create Decoys (-D <decoy1 [,decoy2][,ME],...>)
    Or
    <sourceip><destination ip>decoy<ip>
    The D option allows nmap to create packets that appear to originate from other IP
    addresses. This IP address spoofing allows nmap to simulate many different devices when
    performing certain scans.
    Decoys are useful for testing intrusion detection systems (IDS) or intrusion prevention systems
    (IPS) and their reaction to multiple simultaneous scans. Some IDS/IPS systems capabilities may
    be limited, and the decoy scan can assist in determining the maximum amount of visibility
    expected from these systems under different attack configurations.

    The maximum number of decoys (as defined in nmap.h) is 128. This is a very high
    maximum that probably won't be exceeded in normal use. If too many decoys are used
    during a scan, the performance will decrease as the remote host throttles network traffic
    or if it is overwhelmed.This feature is best used when the destination device is not on the
    same IP subnet as the nmap station. Although the IP addresses are spoofed, the MAC
    address of the nmap station will not be spoofed. Close examination of a network trace file
    on the nmap subnet will clearly show the real hardware address of the spoofed IP
    addresses.
    The decoy option is a good example of how "active filtering" can become a detriment on
    a production network. If decoy stations are used to scan a device, an active firewall
    reconfiguration or active IPS blocking may prevent legitimate traffic from traversing the
    network. An overly aggressive active filtering profile can inadvertently create selfinflicted denial of service attacks! This nmap scan can assist network teams with testing
    and tuning of existing systems to help prevent these situations from occurring.

    Nmap commands:
    1. Scan system with Hostname and IP address.

    2. Scan ports within range.

    3. Print host interfaces and Rounds.

    4. Scan multiple ports.

    5. Scan a host to check its protected by firewall

    6.

    Conclusion: Thus, we have studied and implemented nmap.

    You might also like