NMAP - A Stealth Port Scanner

Andrew J. Bennieston

http://www.nmap-tutorial.com

Contents

1 Introduction 42 Disclaimer 43 Basic Scan Types [-sT, -sS] 4

3.1 TCP connect() Scan [-sT] . . . . . . . . . . . . . . . . . . . . . . 43.2 SYN Stealth Scan [-sS] . . . . . . . . . . . . . . . . . . . . . . . . 5

4 FIN, Null and Xmas Tree Scans [-sF, -sN, -sX] 65 Ping Scan [-sP] 76 UDP Scan [-sU] 87 IP Protocol Scans [-sO] 88 Idle Scanning [-sI] 99 Version Detection [-sV] 1010 ACK Scan [-sA] 1011 Window Scan, RPC Scan, List Scan [-sW, -sR, -sL] 1112 Timing and Hiding Scans 11

12.1 Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112.2 Decoys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112.3 FTP Bounce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1212.4 Turning Oﬀ Ping . . . . . . . . . . . . . . . . . . . . . . . . . . . 1212.5 Fragmenting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1212.6 Idle Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

13 OS Fingerprinting 1314 Outputting Logs 1315 Other Nmap Options 13

15.1 IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1315.2 Verbose Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1315.3 Resuming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1315.4 Reading Targets From A File . . . . . . . . . . . . . . . . . . . . 1415.5 Fast Scan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1415.6 Time-To-Live . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

16 Typical Scanning Session 1417 Frequently Asked Questions 18

17.1 I tried a scan and it appeared in firewall logs or alerts. What elsecan I do to help hide my scan? . . . . . . . . . . . . . . . . . . . . 1817.2 NMAP seems to have stopped, or my scan is taking a very longwhile. Why is this? . . . . . . . . . . . . . . . . . . . . . . . . . . 1917.3 Will -sN -sX and -sF work against any host, or just Windows hosts? 2017.4 How do I find a dummy host for the Idle Scan (-sI)? . . . . . . . . 2017.5 What does ”Host seems down. If it is really up, but blocking ourping probes, try -P0” mean? . . . . . . . . . . . . . . . . . . . . . 2017.6 Where can I find NmapFE? . . . . . . . . . . . . . . . . . . . . . 20