Port Scanning

[KraftDinner]

How exactly does port scanning work? I know it scans for vulnerable ports but does this mean anyone on the network can do this, wouldn't that pose a threat?

[Blade of Grass]

Port Scanning works by sending packets to the target and listening to the response. Normally it scans specific ports (the "Well Known Ports"), but it can also be configured to scan more.

Anyone on the network can do this simply because it's extremely difficult to filter out. How do you know that these packets are not genuine users trying to connect?

It's also only sort of a threat. Port scans may tell an attacker what software is running on the device, potentially even the version (so it may allude to vulnerabilities), but its really more of a recon tool then anything else. So it's only a threat in that it gives an attacker some information about your system

[SpaceNugget]

port scanning can be done in many ways, but basically try to establish connections on all the ports to see what state the ports are in. It doesn't directly pose a threat unless you are sending enough packets to slow down the equipment on the receiving end. It could be dangerous in the sense that having a malicious person knowing things about your network might do harm, but the harm would come after the port scanning, not directly because of the port scanning.

[leadeater]

Try it out for yourself, will give you an idea of what information you can gather.

 

https://nmap.org/

[cortexcortex]

Port Scanning works by sending packets to the target and listening to the response. Normally it scans specific ports (the "Well Known Ports"), but it can also be configured to scan more.

Anyone on the network can do this simply because it's extremely difficult to filter out. How do you know that these packets are not genuine users trying to connect?

It's also only sort of a threat. Port scans may tell an attacker what software is running on the device, potentially even the version (so it may allude to vulnerabilities), but its really more of a recon tool then anything else. So it's only a threat in that it gives an attacker some information about your system

Yeah, all that is correct. The only thing is, it's sort of easy blocking out the scans by simply disabling ICMP requests, since the usual scanner uses the ICMP protocol to check if the port is open. Correct me if I'm wrong.

[SpaceNugget]

Yeah, all that is correct. The only thing is, it's sort of easy blocking out the scans by simply disabling ICMP requests, since the usual scanner uses the ICMP protocol to check if the port is open. Correct me if I'm wrong.

1. Thats still a result. the point of a scan is to determine the state of the port, no response is still a valuable result.

2. Then regular clients can't connect either. if you are scanning a server that hosts multiple web services disabling requests makes that server useless.

[Blade of Grass]

Yeah, all that is correct. The only thing is, it's sort of easy blocking out the scans by simply disabling ICMP requests, since the usual scanner uses the ICMP protocol to check if the port is open. Correct me if I'm wrong.

You are mostly correct. The only issue with this is there are other scanning techniques out there that are very hard to detect and protect against (such as a Maimon scan). 

[cortexcortex]

You are mostly correct. The only issue with this is there are other scanning techniques out there that are very hard to detect and protect against (such as a Maimon scan). 

Thanks

[Fetzie]

Yeah, all that is correct. The only thing is, it's sort of easy blocking out the scans by simply disabling ICMP requests, since the usual scanner uses the ICMP protocol to check if the port is open. Correct me if I'm wrong.

You can also check the security certificates that are accepted for connections as a way to guage if it is worth your time for example.

[KraftDinner]

Port Scanning works by sending packets to the target and listening to the response. Normally it scans specific ports (the "Well Known Ports"), but it can also be configured to scan more.

Anyone on the network can do this simply because it's extremely difficult to filter out. How do you know that these packets are not genuine users trying to connect?

It's also only sort of a threat. Port scans may tell an attacker what software is running on the device, potentially even the version (so it may allude to vulnerabilities), but its really more of a recon tool then anything else. So it's only a threat in that it gives an attacker some information about your system

 

 

port scanning can be done in many ways, but basically try to establish connections on all the ports to see what state the ports are in. It doesn't directly pose a threat unless you are sending enough packets to slow down the equipment on the receiving end. It could be dangerous in the sense that having a malicious person knowing things about your network might do harm, but the harm would come after the port scanning, not directly because of the port scanning.

 

 

Try it out for yourself, will give you an idea of what information you can gather.

 

https://nmap.org/

 

 

Thank you all for the help this really cleared up some confusion