CNET9562 Internet 2004F

Lab #3

Lab 3: Port Scanning with Nmap

Nmap ("Network Mapper") is a free open source utility for network exploration
or security auditing. It was designed to rapidly scan large networks, although it works
fine against single hosts. Nmap uses raw IP packets in novel ways to determine what
hosts are available on the network, what services (application name and version) those
hosts are offering, what operating systems (and OS versions) they are running, what
type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap
runs on most types of computers and both console and graphical versions are
available. Nmap is free software, available with full source code under the terms of the
GNU GPL.

Boot Windows 98 (we need Administrator access to install software.)

Open Internet Explorer. Download the following files from the Lab #3 web site. You
can also download unzip.exe from there, and extract the files from a command
prompt.

nmap-3.75-win32.zip Latest Nmap release for Windows

WinPcap_3_1_beta4.exe Pcap packet capture library for Windows

Remember in which folder you have downloaded the files.

Install Pcap first by running the .exe file. Follow the instructions on screen to do
this.

Open an MS-DOS Window. Change (cd) to the folder where you downloaded the
files earlier.

Unzip the .zip file; an nmap-3.75 folder will be created.

Using Internet Explorer again, go to the main Nmap web site and browse through
the documentation:

http://www.insecure.org/nmap/

Cd to the nmap-3.75 folder, and run nmap -h. This will display the command-line
help screen for Nmap, which will likely scroll off your screen. To capture this output,
redirect the help to a file, and then load the captured output in Windows Notepad:

nmap -h > nmaphelp.txt

start notepad nmaphelp.txt
D:\2004F\cnet9562\labs\lab3\lab3.wpd Page 1 of 2
CNET9562 Internet 2004F
Lab #3
Try the following port scan operations:

nmap -P0 -v -sS technology.niagarac.on.ca

nmap -P0 -v -sV technology.niagarac.on.ca
nmap -P0 -v -O technology.niagarac.on.ca

If a scan produces more than 25 lines of output, you can capture it to a file. For
example,

nmap -oN scan1.txt -P0 -v -sS my.niagarac.on.ca

nmap -oN scan2.txt -P0 -v -sV my.niagarac.on.ca
nmap -oN scan3.txt -P0 -v -O my.niagarac.on.ca

Then you can use Notepad to view the outputs, stored in the files scan1.txt,
scan2.txt and scan3.txt.

Try similar port scans on other hosts. Boot another PC (say, into Windows 2000) in
the lab. Find the IP address, then run Nmap using that IP address.

Note: you cannot scan yourself using Windows.

Try booting the same PC using a different operating system and repeat the port scan.
Compare the results.

Try some of the hosts and IP addresses available on your local network:

192.168.93.1 the L-17 default gateway

192.168.2.10 the primary L-17 DNS server
192.168.2.28 the secondary L-17 DNS server

Other live hosts in the 192.168.2 network: 1, 2, 3, 4, 5, 7, 8, 10, 11, 12, 13, 19, ...

Other hosts in the niagarac.on.ca domain (please be careful and polite!):

lundy.niagarac.on.ca
www.niagarac.on.ca
peoplesoft.niagarac.on.ca
blackboard.niagarac.on.ca
smtp.niagarac.on.ca
email.niagarac.on.ca

When you are done, delete the Nmap software, uninstall the Pcap library, and delete
the files that you have created or downloaded.

D:\2004F\cnet9562\labs\lab3\lab3.wpd Page 2 of 2