Now there are plenty of other network scanning tools and techniques that we need to talk about.
So, first of all, in addition to the popular end map, I want you to be aware of each ping two and
ping three.
These are additional tools that make it very, very easy to perform reconnaissance using primarily ICMP.
Now, in the mobile scanning department, there are many, many tools.
So just imagine how useful this can be.
You whip out your phone when you're connected to the local network and you run IP scanner or thing.
Notice not ping but thing or the network scanner tool.
These are just some of the popular mobile scanning apps that are available for your mobile platforms.
When it comes to discovering hosts on the network, there's ARP based and UDP based PING scans that
tools like and MAP in each ping can accomplish in order to make sure you're finding all of the hosts
that are on the network.
Ping sweep tools include the angry IP scanner.
How's that for a great name?
And SolarWinds has tools that can perform these ping sweeps.
SolarWinds, of course, is featured in one of our ethical hacking in the headline stories as they were
subject to a major attack that we discuss.
Net Scan Tools PRO is another excellent ping sweep tool that you can have in your arsenal when it comes
to port scanning.
Keep in mind that tools like End Map are going to be able to do TCP based scans, UDP based scan streams,
control transmission protocol as well as the Service Discovery Protocol or SDP.
SDP is advertising and allowing discovery of services.
So these are all protocols that port scans can take advantage of when it comes to discovering ports
and services that are available in your infrastructure.
And of course, we can't forget about IPV six.
While IP is the focus today, more and more networks are running IPV six.
So those scans are a possibility as well.
Now, what about countermeasures for this type of reconnaissance against your environment?
Well, let's realize it really all does come down to many times firewalls as well as intrusion prevention
systems and intrusion detection systems.
Now, in addition to that, what I want you doing for the networks that you're in charge of is really
controlling ICMP usage.
Do you even need it in all areas?
And if you do need it, what aspects of ICMP do you need in one of our Hands-On demonstrations?
We went in and we enabled ICMP all ICMP traffic through a firewall.
But would we do this in real life?
Probably not.
Maybe we need dipping and get ping replies through a firewall.
Well, we can be very specific and we can limit just the echoes and the echo responses.
So notice we don't have to take the broad brush approach of denying all ICMP.
We can intelligently filter the ICMP we need in certain areas.
Another excellent idea is to build a DMZ.
These are for the resources that require external access.
The beauty of the DMZ, of course, is that you can give it security measures that are perfectly appropriate
for those resources compared to internal resources that you don't allow anyone to access.
So DMZ, these are going to be a very, very important aspect of your network design to really, really
make it so that when folks are running scans, they cannot access systems.
You don't want them touching.
Well, this is a very involved topic, to be precise, and we're not even done.
But I hope you've enjoyed this.
Look at some other network scanning tools and techniques.
And of course, we discussed mitigations against things like ping sweeps in host discoveries and port
scan.