IP Network Scanning and Security Reconnaissance - Port Scanning
(Page 2 of 4 )
In order to make an effort to fight against network attacks, you must first know a little bit about their nature and technology. The most basic tool in any hacker or network security analyst’s toolkit is port scanning. On every computer, there are 65,535 ports which can allow access to the world into your computer. Fortunately, most computers control these ports effectively and block access to all of them except under special circumstances.
There are two main types of port scanning methods: TCP and UDP. In TCP scanning, a packet of information—generally created with the network technologies of an operating system—is sent to another computer in an attempt to generate a connection. In UDP scanning, a packet is sent much like in TCP, but when the other computer responds to the packet, the original computer will sever the connection. UDP is considerably more efficient in gleaning large amounts of information without a computer becoming entangled in a communication connection. However, because UDP does not use communication, it relies merely on the presence or lack of a response, rather than the information that would be sent through one.
When a user performs a scan on a computer’s ports, a small packet of data will be sent to each individual port, and depending on what is sent back, the user can tell what the status of that port is. A port can be open, closed, or filtered. An open port tells the user that they are capable of sending specific information to that port and receiving information in return. A closed port indicates that the computer will not be sending any communications back to the user, so there will be no communications along that port. A filtered port does not send any response to the user, and is completely inaccessible to the user.
Open ports present the greatest security risk for a computer. If a user is aware of security issues in either the operating system a computer is running or the application which is using given open ports, then they may be able to exploit these issues to gain access to—or block operation of—your computer. Closed ports are slightly more secure, and will only allow a user to take advantage of the computer’s operating system issues. Filtered ports are completely secure and will not grant anyone any kind of access to your computer.
Port scanning grants invaluable information to anyone that is attempting to subvert the security of a network. Without this information, a hacker attempting to gain access to a system might as well be a blind man attempting to use a sniper rifle. As such, the key to securing your network will lie in denying the information gained by port scanning to any intruders.
Next: Reconnaissance >>
More Server Administration Articles
More By Joe Eitel
