Scanning Networks
Scanning finds live hosts, open ports, running services and the operating system. See also footprinting.
TCP flags
SYN, ACK, FIN, RST, PSH, URG. The three-way handshake is SYN → SYN/ACK → ACK.
Nmap scan types
| Scan | Flag | Notes |
|---|---|---|
| TCP connect | -sT |
full handshake, logged, no root needed |
| SYN (stealth / half-open) | -sS |
sends SYN, replies RST to SYN/ACK; default with root |
| UDP | -sU |
slow; no reply may mean open|filtered |
| FIN / NULL / Xmas | -sF -sN -sX |
closed ports reply RST (RFC 793); doesn't work on Windows |
| ACK | -sA |
maps firewall rules, filtered vs unfiltered |
| Idle / zombie | -sI |
spoofs via a zombie host with predictable IP IDs |
Other useful flags: -sV service versions, -O OS detection, -A aggressive, -p- all ports, -T0–-T5 timing, -Pn skip host discovery.
Port states
- open: an application accepts connections
- closed: reachable but nothing listening (RST)
- filtered: a firewall blocks probes, no response
Banner grabbing
Identifying the service and OS from responses. Active: nc target 80, telnet. Passive: sniffing traffic and analysing TTL and window size.