Definition
Port scanning is a technique used to identify open ports and services on a networked device. It helps in mapping the network and finding potential vulnerabilities that could be exploited.How It Works
- 1TCP SYN Scan (
-sS): Sends a SYN packet to start a connection. If a SYN-ACK is received, the port is open. - 2TCP Connect Scan: Completes the three-way handshake. Less stealthy but useful if SYN scan isn't possible.
- 3UDP Scan: Sends a UDP packet. No response suggests an open port; ICMP unreachable messages indicate closed ports.
- 4Service Version Detection (
-sV): Identifies the service version running on an open port. - 5OS Fingerprinting (
-O): Determines the operating system based on network response patterns.
Key Characteristics
- Stealth Scanning: Minimizes detection by intrusion detection systems (IDS) using techniques like TCP SYN scan.
- Aggressive Scanning: Quickly scans all ports but is more likely to be detected.
- Common Ports: Often targeted ports include 22 (SSH), 80 (HTTP), 443 (HTTPS), and 3306 (MySQL).
Comparison
| Feature | Port Scanning | Vulnerability Scanning |
|---|---|---|
| Purpose | Find open ports and services | Identify specific vulnerabilities |
| Tools | nmap, masscan | Nessus, OpenVAS |
| Intrusiveness | Low to Moderate | Moderate to High |
Real-World Example
A notable example is the use of port scanning in the 2016 Mirai botnet attack (CVE-2016-10401), which scanned for open ports on IoT devices to compromise them.Detection & Prevention
- IDS/IPS: Use intrusion detection and prevention systems to monitor for unusual scanning activity.
- Firewall Rules: Limit access to critical ports and services.
- Regular Audits: Conduct regular network scans to identify open ports and services.
Common Misconceptions
- Port Scanning is Always Malicious: Not true; it is a legitimate tool for network defense.
- All Ports Should Be Closed: False; some ports need to be open for services to function properly.
- Port Scanning is Illegal: It's legal when performed with permission on authorized networks.