2KKUU7ita

130
Part III: Hacking Network Hosts
Figure 8-1:
Performing
a ping
sweep of an
entire class
C network
with Nmap.
Ping sweeping
A ping sweep of all your network subnets and hosts is a good way to find out
which hosts are alive and kicking on the network. A ping sweep is when you
ping a range of addresses using Internet Control Message Protocol (ICMP)
packets. Figure 8-1 shows the command and the results of using Nmap to perform
a ping sweep of a class C subnet range.
Dozens of Nmap command line options exist, which can be overwhelming
when you want only a basic scan. Nonetheless, you can enter nmap on the
command line to see all the options available.
The following command line options can be used for an Nmap ping sweep:
✓ -sP tells Nmap to perform a ping scan.
✓ -n tells Nmap not to perform name resolution.
You can omit the -n option if you want to resolve hostnames to see
which systems are responding. Name resolution might take slightly
longer, though.
✓ -T 4 tells Nmap to perform an aggressive (faster) scan.
✓ 192.168.1.1-254 tells Nmap to scan the entire 192.168.1.x subnet.
Using port scanning tools
Most port scanners operate in three steps:
1. The port scanner sends TCP SYN requests to the host or range of hosts
you set it to scan.
Some port scanners perform ping sweeps to determine which hosts are
available before starting the TCP port scans.
Most port scanners by default scan only TCP ports. Don’t forget about
UDP ports. You can scan UDP ports with a UDP port scanner, such as
Nmap.
2. The port scanner waits for replies from the available hosts.