Board scanning is the process of checking for open ports TCB or UDP ports on a remote machine.
It is very important that you think of the traffic implications of your scans before you perform any
as it might have possible effects on the target machines.
We have two methods for scanning ATC people.
The first method is called Connect and the second method is called sin slash stealth.
The first method is purely based on the three way to speed handshake mechanism.
We saw earlier the Connect port scanning involves attempting to complete a three way handshake with
the target host on the specific port.
If the handshake is totally completed this indicates that the port is open.
As for the since Cannes it is a two speed port scanning method that involves only sending send packet
to various ports on the target machine without completing the three way to CB handshake.
If the two sleepy port is open as an packet should be sent in return.
And this means that the port is open without the need to send the final packet to the target machine.
It is called stealth because with the early and primitive firewalls this method like opening half a
three way handshake connection often bypass the logging of the firewall.
But this is not the case anymore with the new firewalls as your scans will be detected UDP scanning
is different than scanning.
As we know that DCP is connection oriented while UDP is stateless so it doesn't involve the three way
handshake mechanism.
So scanning a UDP port is somehow different than scanning it DCP put it is actually important to get
into these details as understanding these basics will help us a lot going through the course.
So how does the scanning work actually an empty UDP packet is sent to the specific port and if the airport
is open.
So we expect no reply will be sent back to us from the target machine but if the UDP port is closed
and ICMP board reachable packet should be sent back to us from the target machine UDP port scanning
is somehow unreliable as firewalls and rotors have the option to drop the ICMP packets so this can be
misleading to us.
So people often forget to scan UDP services and stick only to scanning DCP ports.
One of the most popular and robust port scanners to date is the famous and map two.
Believe me if I say that I saw complete penetration tests and reports which are totally based only in
map 2 so it's a great tool.
It's very important to understand because this will help you a lot in your penetration testing carrier
it has numerous features not only just bought scanning as you will see the default map but DCP scan
will scan like thousand most popular ports on a given machine but again consider the amount of traffic
that you are generating.
So this day 4000 ports can generate up to 70 kilobytes of traffic.
This is only scanning one port so how about scanning like the full all the ports.
This is only scanning thousand ports.
So how about scanning all reports that 6 5 5 3 5 ports on the machine.
It will actually generate around 4 megabytes of traffic so 4 megabytes of traffic just for one post.
How about scanning the full subnet for example the full subnet for a C class network which I like to
5 for hosts.
It will generate lots.
Traffic that can be compared to 1 gigabytes of traffic.
So imagine if we scan a full class B network.
Imagine the size of traffic that we will be generating.