>> Welcome to Module 3 of our Nmap course,
which will focus on the details of
TCP/IP that are relevant to Nmap.
In this first lesson, we will talk about IPv4.
There isn't a lab in this lesson,
so feel free to listen or learn from
a device that isn't running and Nmap.
Let's get started. Here are
the learning objectives for this lesson.
First, we'll start with a general discussion
of TCP/IP version 4.
Next, we'll discuss IP addressing.
Then we'll talk about CIDR notation,
and finally, we'll talk about name resolution.
Because most of you know how IPv4
and many of its associated protocols work.
I'll work hard to focus on the things relevant to Nmap.
One of the prerequisites of this course
>> is that you have
>> some knowledge and experience with
the TCP/IP protocol suite.
I'm not going to bore you with a ton of detail about
the OSI Model or history of TCP/IP.
I just want to review a couple of
things that are relevant to this course.
TCP/IP version 4 is after all,
what most lands and lands still currently use either
exclusively or in a dual-stack with IPv6,
TCP/IP is generally made up of two key protocols.
TCP, which is
a connection-oriented layer 4 or transport protocol,
and IP, which is a layer 3 or network layer protocol.
Connection-oriented means that the state of
each TCP/IP connection is
maintained in order to guarantee delivery of packets.
One key aspect of this is TCP is a three-way handshake.
The TCP/IP protocol suite
also includes a bunch of other stuff,
including the User Datagram Protocol or UDP,
which is a connectionless transport protocol
that may be used as an alternative to TCP,
and has less overhead as we'll see
when examining all the protocol headers.
Both TCP and UDP use port numbers as a way to
determine what service or
application data is transferred to.
In Nmap, knowing how IP addresses are assigned locally,
either statically or through DHCP
helps when determining target hosts and networks.
In America, ISPs and
corporations can obtain static publicly
accessible IP addresses through
the American Registry for Internet Numbers or ARIN.
Many times network administrators get
their public IPs from their ISP.
Typically, they issue out private addresses using
a private IP addressing scheme that
uses Network Address Translation
>> to dock on the Internet.
>> In Nmap, it really helps to know the difference
between private IP addresses and public IP addresses.
It also helps if you're familiar with or have
memorized common TCP and UDP ports.
However, one of the beauties of Nmap is
that a default Nmap scan automatically
probes for 1,000 of
the most commonly used TCP and UDP ports.
Using the dash capital F command-line switch will
cut that number down to 100
of the most commonly used ports.
I'll include a cheat sheet with
the 100 most commonly used
TCP and UDP ports, in this lesson.
In IP addressing,
numbers are usually seen in their decimal forms,
such as 192.168.1.1.
There are four sets of numbers
separated by decimal points.
These numbers are read by
network devices in their binary form.
Each set is called an octet.
It's called an octet because the maximum value in
each set is two to the eighth power minus one,
because zero can be assigned as a value.
In other words, 255 is
the maximum value that can be assigned in each octet.
255 in binary is 11111111 or eight ones.
Most of you have knowledge and experience with this,
so I'm not going to go into too
much more detail about it.
The process of sub-netting is usually one of
the first mathematical encounters
that network administrators must learn.
It's a rite of passage.
At its heart, sub-netting is
simply addressing methodology that allows
network admins to determine which portion of
the IP address is the network
>> and which part is the host.
>> They do this by assigning a combination
of IP address and subnet mask.
On many LANs, a common subnet mask for
each VLAN is 255.255.255.0.
This tells you that the first three octets
of the IP address determine the network,
and the fourth is the host.
Every network device in that
VLAN will share the same first three octets,
such as 192.168.1 and
each device on the network will have
a different and unique last octet.
In Nmap, it helps to understand all of
the different private addressing schemes and
how to determine what network you're scanning from.
In Windows, you can determine your network by running
an IP config at the command prompt
and looking at your IP address and subnet mask.
In Linux, Unix,
including the macOS,
you can determine it by running
>> ifconfig from a terminal.
>> One really important thing to understand in
Nmap is that the only way to determine
a device is a physical address or
MAC address is by sitting on that network.
In other words, there really isn't
a way to determine the MAC address of
a remote host without having
administrative privileges to the router
or switch that that device sits on.
The only exception to this is when you're scanning
station sits on a span or mirrored port.
CIDR or cidr stands for Classless Inter-Domain Routing.
Rather than bore you with why it's called
that or many other details,
I'll boil it down to one simple thing.
CIDR notation is an IP address followed by a slash,
followed by a number that represents the number of bits
used to represent the network portion of the address.
In other words, the number after the slash
is a simple representation of the subnet mask.
Using our example from the previous slide,
255.255.255.0 is three octets of eight ones or 24 bits.
Or another example would be 255.255.0.0,
which is simply the same as two octets of eight ones.
An IP address such as 172.16.1.0,
followed by a slash 16 would be the same as
that IP address with a subnet mask of 255.255.0.0.
In Nmap, you can use
IP address in cidr notation as a target.
The great thing about doing it this
way is that it's quick.
One of the reasons we're going
through all of this background is
to learn ways to write efficient Nmap scans.
If you don't fully understand CIDR notation,
I suggest learning it. You'll be happy you did.
DNS stands for domain name system.
DNS translates names to IP addresses,
as seen earlier in this course,
you can use a fully qualified domain name such as
scanme.Nmap.org as a target for a scan.
By default, Nmap will use
your computer's name servers when running a scan.
However, you can tell Nmap
what name servers to use for a scan.
In other words, you can use alternate name servers.
This is helpful in case you either don't
trust your own name servers or if you want to
see if there are differences
between the way your name server
resolves names relative to other name servers.
One obvious reason you might do
this is to see if a computer network
or DNS server have been compromised by an attacker.
Understanding the way DNS works
can really help you in using Nmap.
In this short lesson, we talked about
the TCP/IP version four protocol suite
with a focus on relevance to Nmap.
We started with a discussion of IPv4.
We then talked about IP addressing.
We moved on to CIDR notation
and we finished up with name resolution.
Thanks so much for walking through this lesson with
me and I'll talk to you again in the next one.