Wireless Hacks. 1917 IndustrialStrength Tips and Tools [Electronic resources] نسخه متنی

Hack 40 Interrogating the Network with nmap

When you absolutely need to know everything you
can about a network or host, nmap can help.

The network monitoring tools discussed so
far all achieve their goals by passively listening to traffic on the
network. You can often get better results by actually asking machines
directly for information rather than waiting for them to divulge it
on their own. To find out more information about a particular machine
(or an entire network of machines), you need a good active scanning
utility. One of the most advanced and widely used network scanners is
nmap. It is available at http://www.insecure.org/nmap/, and is best
summarized by the description on the web site:

Nmap uses raw IP packets in novel ways to determine what hosts are
available on the network, what services (ports) they are offering,
what operating system (and OS version) they are running, what type of
packet filters/firewalls are in use, and dozens of other
characteristics.

The most common use for nmap is to scan the TCP
ports on a machine to determine which services are available. If run
as root, it can also use advanced TCP fingerprinting techniques to
make an educated guess about the OS of the target machine.

caligula:~# nmap -O 10.15.6.1
Starting nmap V. 3.00 ( www.insecure.org/nmap/ )
Interesting ports on florian.rob.swn (10.15.6.1):
(The 1590 ports scanned but not shown below are in state: closed)
Port       State       Service
22/tcp     open        ssh                     
53/tcp     open        domain                  
80/tcp     open        http                    
179/tcp    open        bgp                     
443/tcp    open        https                   
2601/tcp   filtered    zebra                   
2605/tcp   filtered    bgpd                    
3128/tcp   filtered    squid-http              
3306/tcp   filtered    mysql                   
10000/tcp  open        snet-sensor-mgmt        
10005/tcp  open        stel                    
Remote operating system guess: Linux Kernel 2.4.0 - 2.5.20
Uptime 65.988 days (since Thu Apr 17 18:33:00 2003)
Nmap run completed -- 1 IP address (1 host up) scanned in 33 seconds

This scan was run on a server on my home network. The operating
system guess and system uptime are both correct (it is a Linux 2.4.19
system that has been up for 65 days, 23 hours, and 43 minutes).
Notice how nmap can also detect filtered TCP ports in addition to
ports that accept connections. There is no guarantee that these
services are actually in use, but since there is a firewall running,
it's probably a good guess that at least some of
them are active. Ports 10000 and 10005 are actually part of a
home-grown monitoring system I'm using, as described
in [Hack #34]. If you are curious about a
particular user on your wireless network, nmap can tell you a good
deal about the system they are running.

Aside from scanning the ports of a single host,
nmap can also scan entire networks.
To fingerprint all of the machines on the local network, try
something like this:

caligula:~# nmap -sS -O 10.15.6.0/24

The /24 is Classless Inter-Domain
Routing (CIDR) notation for the network mask,
specifying that all IPs from 10.15.6.0 to 10.15.6.255 should be
scanned. If the machine being scanned is running a good
intrusion detection system (such as
Snort; see http://www.snort.org/), it might determine
that a scan is in progress and take countermeasures. To try to work
around this possibility, nmap provides a number of alternative
scanning methods that can be very difficult to detect. The
-sS switch tells nmap to use a stealth SYN scan
rather than use a standard TCP connect. The scanning tool versus
intrusion detection tool arms race has been going on ever since there
have been such tools, and will likely continue for quite some time.

You can use nmap to help track down miscreants abusing your network,
or simply to take a poll of what your wireless users are running. It
is frequently used to probe your own machines to determine whether
unexpected services suddenly crop up, or whether your firewall is
properly configured. However you use it, nmap will provide valuable
insight into the machines present on your wireless network.