Nmap employs various stealth scanning techniques to identify active hosts on a network while minimizing the risk of detection by firewalls and intrusion detection systems (IDS).
These methods focus on sending packets that are less likely to trigger alerts. Key techniques include:
1. SYN Scan (-sS):
Also known as half-open scanning, this method sends TCP SYN packets to target ports without completing the full three-way handshake. If a SYN/ACK response is received, it indicates the port is open; Nmap then sends a RST packet to terminate the connection before it's fully established. This approach is less likely to be logged by the target system.
2. FIN Scan (-sF):
This technique sends TCP packets with only the FIN flag set. According to RFC 793, closed ports should respond with a RST packet, while open ports typically ignore the FIN packet. This behavior allows Nmap to infer the port's status.
3. NULL Scan (-sN):
In a NULL scan, Nmap sends TCP packets with no flags set. Similar to the FIN scan, closed ports are expected to reply with a RST packet, whereas open ports usually provide no response. This minimalist approach can evade some detection mechanisms.
4. Xmas Scan (-sX):
Named because the packets are "lit up like a Christmas tree," this scan sets the FIN, PSH, and URG flags in TCP packets. The responses are interpreted similarly to FIN and NULL scans, aiding in stealthy port detection.
5. Idle Scan (-sI):
This advanced technique uses a "zombie" host to scan the target, making the scan appear as though it originates from the zombie. By analyzing predictable IP ID sequences from the zombie, Nmap can infer open ports on the target without direct interaction, effectively masking the scanner's identity.
6. Timing and Fragmentation Options:
Nmap offers timing controls (-T0 to -T5) to adjust the scan speed, with slower scans being less likely to trigger alerts. Additionally, packet fragmentation can be employed to split probe packets into smaller segments, potentially bypassing simple signature-based detection systems.
By leveraging these methods, Nmap can effectively identify active hosts and open ports with a reduced risk of detection, facilitating discreet network reconnaissance.
