Written By Fyodor

http://insecure.org

Free!

TCP – Transmission Control Protocol

UDP – User datagram protocol

(Unless you u an IP address)

Step 2 :Nmap “Pings” the remote device

(This is not an ICMP echo Request)

Step 3: Reverse DNS lookup

Step 4: Do the scan!

TCP connect() scan (-sT)

Ping scan (-sP)

Excluding from command line or a file

Using a file to list your targets

Port Number options

Limit your scans

Command line only

Must specify each time

--excludefile <exclude_filename>

One option excludes many hosts

-p<port range>

Default pings

ARP ping

ICMP and TCP ACK ping

TCP SYN ping

UDP ping

An Nmap ping does not(necessarily) refers to an ICMP echo request

For the remote ip subnet nmap uses

ICMP echo request &

Systems with Firewalls & Filter

One port open ,one port closed.

Often called “stealth” scans

One frame transmitted, one frame received

Thesestealth scans never appears in application logs.

-T1/sneaky

-T2/Polite

-T3/Normal

-T4/Aggressive

Rearrange the Nmap hosts in an Nmap scan

Makes it difficult to see a pattern

Completely random target addresses

(-iR <num _host>)

Useful for finding specific services