2KKUU7ita

132
Part III: Hacking Network Hosts
Figure 8-2:
In-depth
portscanning
options in
NMapWin.
Figure 8-2 shows the NMapWin Scan tab, where you can select the Scan Mode
options (Connect, UDP Scan, and so on). If you’re a command line fan, you
see the command line parameters displayed in the lower-left corner of the
NMapWin screen. This helps when you know what you want to do and the
command line help isn’t enough.
If you connect to a single port (as opposed to several all at one time) without
making too much noise, you might be able to evade your firewall or IPS. This
is a good test of your network security controls, so look at your logs to see
what they saw during this process.
NetScanTools Pro
NetScanTools Pro (www.netscantools.com) is a very nice all-in-one commercial
tool for gathering general network information, such as the number
of unique IP addresses, NetBIOS names, and MAC addresses. It also has a
neat feature that allows you to fingerprint the operating systems of various
hosts. Figure 8-3 shows the OS Fingerprinting results while scanning a
Linksys router/firewall.
Countermeasures against ping sweeping and port scanning
Enable only the traffic you need to access internal hosts — preferably as far
as possible from the hosts you’re trying to protect — and deny everything
else. This goes for standard ports, such as TCP 80 for HTTP and ICMP for
ping requests.