Master Port Scanning with Nmap

Getting Started

Start Nmap in a terminal window by simply typing nmap and you'll see a long list of
options as in figure 1.
Once you've got the hang of the basics it's worth experimenting with some of these,
but to get started with a very quick indication of the machines on your network, type
nmap sP 192.168.1.*.
The sP option makes Nmap perform a ping scan on all the IP addresses in the
specified IP range (in this case 192.168.1.1-255), listing the hosts which respond, as
in figure 2.
By default Nmap actually performs a ping scan before doing any other type of scan to
establish which IP addresses are actually in use, ignoring any addresses which don't
reply to the ping. This means that if any remote hosts or anything between you and
the remote hosts blocks these pings then Nmap will not be aware that they exist, and
won't attempt to interrogate them further. Fortunately you can get around this by
using the p0 option, which forces Nmap to scan any addresses you specify,
regardless of whether they respond to a ping.
If you know you have a host on your network at
192.168.1.150 that is not responding to a ping, you
can still investigate it using nmap P0
192.168.1.150. (See figure 3) By default Nmap
only scans a subset of all the available ports, so to
investigate a machine more rigorously you can use
Figure 3.
the p option to specify the ports you want to scan
for example all ports in the range 1-65535: nmap p 1-65535 192.168.1.150
(See figure 4)
The p option is also useful if you want to
investigate machines on your network with a
specific port open, such as port 139 (Netbios
session service):
To restrict your scan of port 139 to a subset of your
network, simply type in an IP address range: nmap
p 139 192.168.1.1-20 (See figure 5)

UDP Scanning

As well as various TCP scans, nmap can be made to

http://www.enterprisenetworkingplanet.com/netos/article.php/3716606 (1 of 2) [18/06/2008 09:18:47 p.m.]

Figure 4.

Master Port Scanning with Nmap

perform a UDP scan using the sU option to get

further port information: Nmap sU
192.168.1.150 (See figure 6)

It's worth noting that UDP scanning works in the

Figure 5.
opposite way to TCP scanning. Since a TCP session
is initiated by the three-way handshake, nmap's
default SYN scan can tell if a TCP port is open when
it receives a SYN/ACK packet in response to its SYN
Figure 6.
packet. UDP sends no such an acknowledgement
the only response it is likely to receive is an
ICMP_PORT_UNREACH error packet from a closed port. So no response indicates that
a UDP port might be open, but just to make things more complicated, no response
could also simply mean that the UDP or ICMP packet got lost (or filtered). Nmap
retransmits packets that may have got lost to cut down on false positives, but the
bottom line is that when Nmap reports an open/filtered UDP port, this may not
actually be the case.
It's also worth noting that non-Microsoft systems limit the number of ICMP Port
Unreachable messages generated in a given time period, so scanning these systems
can be very slow indeed

http://www.enterprisenetworkingplanet.com/netos/article.php/3716606 (2 of 2) [18/06/2008 09:18:47 p.m.]