6th European Conference - Academic Conferences

Muhammad Naveed
response could also mean that a packet filter dropped the probe or any response it
elicited. So Nmap does not know for sure whether the port is open or being filtered. The
UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way.” (Nmap Reference
Guide)
4.6 closed|filtered
“This state is used when Nmap is unable to determine whether a port is closed or filtered.
It is only used for the IP ID idle scan.” (Nmap Reference Guide)
5. Benchmark for the analysis
The study was based on the following types of organizations:
Educational and Research
Commercial Organization
News Channels
Before analysis of the webservers in Pakistan, benchmark is set for the analysis using the famous
organizations, which were assumed to be secure and the scans also showed them to be secure. As
the study is based on the three types of organizations, we have set benchmarks for each of them.
5.1 Education and research organizations
To set the benchmark for education and research organization, Massachusetts Institute of
Technology (MIT) webserver was scanned using its domain address. The scanned results show the
best security, which is very impressive and attests that highly skilled and information security aware
people are working in the network.
The MIT’s scan result shows that only opened ports are those that are used by webserver and they
should be open for the web service, all other ports are blocked. The aggressive operating system
scan reveals with 94% accuracy that FreeBSD operating system is running on the server.
The scan results for MIT are shown in Table 2 to Table 4.
Table 2: Scan details for MIT
Scanned Web Server www.mit.edu (18.9.22.169)
Scan Launching Time 2010-08-14 00:50 PKST
Scan Type Slow Comprehensive Scan
Scan Time 2935.93 seconds
Raw packets sent 4150 (156.946KB)
Raw packets received 483 (29.058KB)
Table 3: Port scan results for MIT
Port Protocol State Service
80 Tcp Open http
443 Tcp Open http
8001 Tcp Open http (probably for MIT Radio)
Table 4: Aggressive OS scan results for MIT
OS Name and Version Type Vendor OS Family OS Generation Accuracy of result
Free BSD 6.2-
General FreeBSD FreeBSD 6.X 94%
RELEASE
Purpose
To further enhance the benchmark Indian Institute of Technology at Delhi was also analyzed which
also revealed that the webserver is very secure. The only ports that were found open were the ports
that are used by the webserver to provide web services. All other ports that were used were either
behind the firewall and were protected or they were blocked. Aggressive operating system scan
191