Unix Backup and Recovery

Mapping Your Network: The nmap Utility

The Network Mapper, or nmap, is quite a bit more sophisticated than queso. Whereas queso can be passed only a single IP address or hostname, you can tell nmap to scan an entire range of IP addresses, such as your entire Class B network. Although it does detect the operating system of remote systems, it also can be used to detect security holes in your network. Here is a quote from the nmap web site that explains how it works:

Nmap is a utility for port scanning large networks, although it works fine for single hosts. The guiding philosophy for the creation of nmap was TMTOWTDI (There’s More Than One Way To Do It). This is the Perl slogan, but it is equally applicable to scanners. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols (UDP, TCP, ICMP, etc.). You just can’t do all this with one scanning mode. And you don’t want to have 10 different scanners around, all with different interfaces and capabilities. Thus I incorporated virtually every scanning technique I know into nmap. Specifically, nmap supports:

• Vanilla TCP connect( ) scanning,

• TCP SYN (half open) scanning,

• TCP FIN, Xmas, or NULL (stealth) scanning,

• TCP ftp proxy (bounce attack) scanning

• SYN/FIN scanning using IP fragments (bypasses packet filters),

• UDP raw ICMP port unreachable scanning,

• ICMP scanning (ping-sweep)

• TCP Ping scanning

• Remote OS Identification ...