Home  |  Map  |  Index  |  Search

Convert to GutenPalm or to PalmDoc by Danilo Lujambio Content: Scanning with TCP, three way handshake of TCP (option -sT) Scanning using SYN segments (half open, option -sS) Scanning using the FIN segments Functionality of tcpdump that can help TCP (RFC 793) Conclusion Bibliography Talkback form for this article

Learning with nmap

Abstract:

Why are scanners so important for the security of networks? Basically because they are essential tools for those who want to attack a system. The preparation of an attack by a cracker could look as follows:

• Scan a target machine or selected network, observe which services are offered and which operating systems runs these services, and work on some well-known vulnerability in any of them.
• Scan any network or machine, look for a service or operating system (including the checkup of the version) with a known vulnerability.

For a system administrator who is aware of system security, it is important to carry out a scanning of their own network, and look for vulnerabilities before others do it with not so good intentions.

There are several scanning tools for this purpose, but the article will only look at nmap. Nmap is among the most complete scanners and security tools.

Nmap allows the system administrator to scan the networks in order to know which servers are active and which services they offer. For this purpose, nmap offers several scanning techniques. This article will work on a limited number of them, reviewing (maybe teaching?) some aspects of TCP protocol

The strategy in this article will be to show some of the more common ways to use nmap, to obtain information about systems and, in parallel, show how to find traces of scanning on the target side.

The nmap can be obtained from www.insecure.org. After downloading run:

tar zxvf nmap-2.30BETA17.tgz
cd ...../nmap-2.30BETA17/
./configure
make
make install

The nmap output is usually a list of "interesting" (active) ports on the scanned target machine. These ports provide you with the name of the service, the state and the protocol.

Scanning with TCP, three way handshake of TCP (option -sT)

The simpler form of nmap scanning is done with option -sT. It is based on the method of establishing a connection in the TCP protocol, known as a three way handshake. The sequence [1] is roughly described below

1. The server must be ready to receive a connection (usually using the socket, bind and listen functions)
2. The client starts an active connection - a call to connect (). This sends a SYN segment to the server to inform about the initial sequence number of the data that client will send during connection. The SYN usually contains an IP Header - a TCP Header and maybe some TCP option.
3. The server should acknowledge the SYN sending with an ACK and a SYN with its sequence number (within the same TCP package).
4. The client should acknowledge the server SYN with an ACK

This way of scanning has two advantages:

• it is fast (nmap even has options that we will not analyze to make it faster on slow connections)
• special privileges are not needed on the machine that launches the scanning

We will follow the procedure used by nmap option -sT, running tcpdump in the target machine. nmap is executed on machine 192.168.255.20 and points toward machine house2.xxx.xxx.xxx, through an Ethernet network.

This run allowed nmap to detect that port 110 (pop3) of house2 is an active one on this machine.

As stated above, this way of scanning is easy to detect, using the prints left in file /var/log/messages (although this depends on the way that syslog.conf was configured) the connection seen in lines 5 to 8 produced:

May 6 08:24:01 house2 in.pop3d[205]: connect
from root@192.168.255.20

Scanning using SYN segments (half open, option -sS)

This scanning type is performed by executing nmap with option -sS. The technique used is to open a "half connection": we send a SYN segment and, if an ACK is received then we have detected an active port on the target machine, and we sent a RESET to close the connection promptly. If we receive an RST instead of an ACK, then the scanned port is not active. This scanning procedure has the drawback that root privileges are needed to execute it. But it has the advantage that is difficult to detect in the scanned machine.

Let's see a similar analysis of the actions done by nmap with this option, analyzing it with tcpdump (with lines numbered again for easier description)

This scanning over house2 didn't leave any trace in the file /var/log/messages, as stated earlier.

Scanning using the FIN segments

This scanning is based on the fact that inactive ports on the target machine respond to a FIN package with a RST package. On the other hand, active ports simply ignore those packets. Therefore the list of interesting active ports is obtained by observing which are those that have not answered. Hosts running Microsoft operating systems can not be scanned with this method since they have a non standards-conforming implementation of the TCP protocol.

There are three forms of operation of nmap using similar techniques, achieved through options -sF, -sX and -sN. We will further analyze the behavior of option -sF, performing an analysis similar to the one for the previous sections.

In lines 1 and 2 the FIN segment delivery (notice the F after the 864 in line 1) is observed on the target host, which answers with a RST packet (notice the R in line 2 after the 35600). nmap concludes that the 864 in house2 is not active.

Lines 3 and 4 take the pop3 port on house2 as an example. In line 3 we see a FIN segment sent, which doesn't get an answer from house2. Line 4 was a surprise, being probably a measure taken by nmap to check the status of that port, sending another FIN segment to ensure that port is not answering. In both cases, house2 ignored the packets, showing to nmap that port pop3 is active.

Functionality of tcpdump that can help

In the section about "the three way handshake scanning" you saw the traces that a scan can leave behind, and in the later sections, you saw the scanning with options -sS and -sF that don't leave any footprints. We can use tcpdump to detect this type of scanning on a host connected to a network which could be a target of attacks. The drawback of tcpdump is that it generates an enormous amount of information and raises difficulties with regards to storage and analysis. Some expressions are shown here that act like filters, such that the information obtained is smaller and simpler to analyze.

To make it easier to understand the expressions, we show below the format of a TCP packet [2].

TCP (RFC 793)

0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port          |        Destination Port       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                         Sequence Number                       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                      Acknowledgement Number                   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Offset |  Reserver |U|A|P|R|S|F|             Window            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           Checksum            |         Urgent Pointer        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                  Options                      |    Padding    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                              Data                             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

We see that the 13th byte is the one where the flags resides which identifies the kind of packet (SYN, FIN, etc.). With this knowledge and the and (&) operator we can construct masks to detect the active bits, building expressions such as

tcpdump ' tcp[13] & 7 != 0 and dst 192.168.255.20 ' > /tmp/out7

which filters the input leaving the packets with bits R, S or F active (the mask is 00000111) with 192.168.255.20 as destination host (obviously this number IP will be looked at by the machine)

Using

tcpdump ' tcp[13] & 1 != 0 and dst 192.168.255.20 ' > /tmp/out1

we will obtain the packets with an active FIN bit (the mask is 00000001). It can be useful to detect the nmap scanning with option -sF. And with

tcpdump ' tcp[13] & 2 != 0 and dst 192.168.255.20 ' > /tmp/out2

we will get only the packets with an active SYN bit, being useful to detect scans with option -sS

For the last type described (with option -sS) there are specific detection programs available [3].

Conclusion

Programs such as nmap are very useful to improve the system security by looking at networks through the eyes of a potential cracker. We have shown the operation of a rather small part of the options, but hope it helps you to understand the idea of network scanners a bit more.

Bibliography

[1] W. Richard Stevens Unix Network Programming Volume 1
[2] RFC 793
[3] to see nmap documentation

Talkback form for this article

2001-06-29, generated by lfparser version 2.16