The Network Security Test Lab: A Step-by-Step Guide

CHAPTER 4 Detecting Live Systems and Analyzing Results

This chapter examines the tools, techniques, and methods used for detecting live systems. While many books simply discuss what port scanning is, this chapter goes much further by looking at the actual protocols to understand how port scanning works and why specific protocols and applications respond in specific ways. It dissects the protocols, looks at how they work, and shows you how to analyze the results you obtain from specific types of scans.

Port scanning is one of the most widely used methods of service and system identification. Just consider the fact that before a system can be attacked, it must be identified. For example, an attacker may have an exploit that works against a Microsoft Internet Information Services (IIS) server. Using that exploit against an Apache server would be useless. So, the attacker must first confirm that the targeted computer is actually running IIS. To make this analysis more true to life, assume that the exploit may only work against IIS version 7.5. If this is the case, then knowing that a system is running Microsoft software will still not be enough; the attacker needs to know that the service version is actually IIS v7.5.

This is where the power of port scanning comes in. Port scanning can not only identify ports but, depending on the tool that is used, also provide information about the possible service running on that open port. Before you start performing any port scans, you should ...