Port scanner
lastmod 2024-02-26created 2018-09-145 edits
A port scan means searching a running server for open TCP/UDP ports.
Port scanning methods
TCP scan
A TCP scan is a technique that detects the 3-way handshake that occurs when a TCP connection is first established. If the handshake completes normally, the TCP port can be judged to be open. To avoid a denial-of-service attack, the port scanner closes the connection right after the handshake.
Because this method uses the ordinary socket connect(), programs such as Nmap call it a connect scan.
SYN scan
A SYN scan does not complete the full TCP handshake; it finishes the check after receiving only the first SYN packet. Because no actual TCP connection is made, this method is also called a 'half-open scan".
This method cannot use the connect() function like the TCP scan does; the port scanner builds the TCP packets itself for this scan.
UDP scan
Unlike TCP, the UDP protocol has no handshake, so in general the server may not respond at all even when the port is open. However, many systems send an ICMP unreachable message when there is no response to a sent packet. Many UDP scanners work by detecting this message. With this method, if the server does not send ICMP messages, a closed port may be judged to be open.
Another method is to send a packet of the protocol that corresponds to each port. For example, a DNS server runs on port 53, so the UDP scanner sends a DNS request packet to that port and waits for a response. This method is limited to well-known ports and their protocols, but it can be used when there are no ICMP messages.
Port sweep
A port sweep means checking ports to detect a specific program running on a system. Port sweeps are also used to find system vulnerabilities: if a program that uses a specific port has a vulnerability, an attacker only needs to find servers with that port open and attack them. For example, computer worms that exploit a Microsoft SQL Server vulnerability check TCP port 1433.
Examples of finding open port numbers
Scan port 80 on the target system with tcping:
Scan port 80 on the target system with nmap:
How to do ONVIF#Scan with nmap:
Scan IPs from 192.168.0.1 to 192.168.0.255 for those accepting SSH (22) connections with nmap:
nc command: