Nmap Scan Techniques - SYN, Connect

Once the discovery stage is done Nmap moves onto scanning the ports for interesting services.

As default, as I've said, this is those 1000 top used Port's using a SYN scan S Y N scan.

Most of the scan types are only available to privileged users.

This is because they send and receive raw packets, which requires route or admin access.

Nmap attempts to produce accurate results, but keep in mind that all of its results are based on packets returned by the target machine or the firewall in front of them in such hosts may on trustworthy and send responses intension to confuse or mislead us scanner.

Much more common are non RFC compliant hosts that do not respond as they should to Nmap probes.

Fin, NULL, and XMAS scans are particularly acceptable to this.

As you can see here, there are a dozen or so scan techniques available.

Only one method of scanning can be used at any one time, except that the UDP scan, which you can see here and any one of the S C T P scans, maybe use with any of the TCP scans, which you can see here.

So generally it's just one of these that can be used unless you're using UDP, which you can use.

One of these and UDP at the same time to try and remember all of the switches.

Just remember that it starts with a little s followed by a prominent character in the scan name.

And that's usually the first character.

So we've got the s and then big S, which is the SYN scan.

We've got the T, which is the connect to, and then we've got A for ACK window, etc. U for UDP. NULL, FIN, XMAS. So [00:02:00] that's the way you can attempt to try and remember them, but mostly SYN ACK and UDP are the ones that you use here.

We can see the S capital S the SYN scan is the default and most popular scan option, because it can be performed quickly scanning thousands of port per second, on a fast network.

There's not hampered by restrictive firewall. It is also relatively on obtrusive and stealthy since it never completes TCP connections.

We click over here. We can see an example of the command Nmap target minus S capital S and I've added the verbose there, but if we didn't have the minus S capital S it would be doing this SUN scan anyway, because I said, it's the default.

This technique is often referred to as a half open scan because you don't open a full TCP connection.

You send a syn packet as if you're going to open a real connection and then wait for a response.

A SYN ACK indicates the port is listening.

It's open while a reset and RST packet is indicative of a non.

If no response is received after several retransmissions, the port is marked as filtered.

The port is also marked as filtered.

If an ICMP unreachable error, one of the error messages type three code one, two, etc, is received.

The SYN scam works against any compliant TCP stack rather than depending on idiosyncrasy.

All specific platforms as Nmap, FIN, NULL, Xmas, Maimon and idle scans do it also allows clear, reliable differentiation between the open closed and filtered states.

So it is generally in many cases the best option to use, and it is the default option.

Anyway, if you were just to do that, Alright, Nmap help here.

We can see the S capital T, which is the connect scan, which looks like this.

You obviously don't need the minus V but I always add it for the boasts TCP connect scan is the default TCP scan.

When SYN scan is not available, basically when you're not running as a route and your account doesn't have rural packet privilege.

With a connect scan instead of writing raw packages as most other scan types do.

Nmap ask the underlying operating system to establish a connection with the target machine and port by issuing the connect system call when SYN scan is available, it is usually the better choice Nmap has.

Less control of the high-level connect core down with raw packets, making the connect, scan less efficient.

The system call complete connections to open target port rather than performing the half open reset that the syn scan doors.

So the connect scan takes longer and requires more packets to obtain the same information and target machines are more likely to log the connection.

A decent IDs will catch.

Either scan type SYN or connect, but most individual machines have no alerting system, many services on your average Linux system will add a note in your SIS log and sometimes a cryptic error message when Nmap connects, and then close the connection without sending any data.

An admin who sees a bunch of connect attempts in the logs from a single system will know they have been scanned.

For external systems.

This is an every hour or every minute occurrence for internal systems.

This would be quite rare.

So making connects is more noisy, certainly in terms of IDs and logs and making SYN connections is less noisy, but nowadays people do know the scanners use SYN connections.

So it's not as stealthy as it was say, 10 years ago to use SYN scan.

So that's the connect scan.

Let's just run it here because we're running against a single machine.

This will be very, very quick 1.3, one seconds.

But as, SYN scan would be quicker and certainly much quicker against lots of hosts.