What can you tell me about traffic and the scanning process?
To know about the traffic, it's important to understand the scan process itself. Usually port scanning means scanning for TCP ports, which are connection-oriented and therefore provide good feedback to the attacker, but UDP responds in a different manner. In order to find UDP ports, the attacker generally sends empty UDP datagrams. If the port is listening, the service will send back an error message or ignore the incoming datagram. If the port is closed, then most operating systems will send back an "ICMP Port Unreachable" message. Thus, an attacker finds out if a port is NOT open, and by exclusion determines which ports are open. Neither UDP packets, nor the ICMP errors are guaranteed to arrive, so UDP scanners of this sort must also implement retransmission of packets that appear to be lost or you will get a bunch of false positives. Also, this scanning technique is slow because of compensation for machines that implement the suggestions of RFC 1812 and limit ICMP error message rate. For example, a kernel may limit destination unreachable message generation to 80 per four seconds, with a 1/4 second penalty if that is exceeded.
A SYN scan or "half-open" scan on the other hand are another way an attacker can try to enumerate ports on a system in a stealthy manner. These scans only execute the first two steps of the TCP three-way handshake. The initiating system sends TCP SYN packets as though it were requesting to open a full connection. The target system responds with a SYN-ACK packet. The initiator then sends a TCP RST (reset) packet back to the target, thereby closing the connection. The idea here is to prevent the full connection from being established since it may possibly be logged. Most of the Scanners also allow SYN scans using UDP packets in much the same manner.
This was last published in February 2005
Dig Deeper on Network Security Monitoring and Analysis
Find out if there's a difference between a virtual private network (VPN) concentrator and a network access server (NAS) in this explanation from our ...
Continue Reading
Our network security expert explains how to keep unauthorized users from accessing your router's IP address for Internet access in this advice ...
Continue Reading
If you've used MAC address restriction to control your network access on your wireless router, can you extend this to your wired network? Our ...
Continue Reading