Hello, my name is Stephan.
Welcome to our Nmap lecture.
In this lecture, we will dive into the exciting world of network reconnaissance.
So today we will explore a crucial task for penetration testers and system administrators, like finding
online hosts.
So we will discover how Nmap, the go to tool for network scanning, offers enhanced host detection
capabilities and provides valuable insights beyond the traditional ping utilities.
Segment one The Importance of Host Discovery.
Before we begin our exploration of Nmp's capabilities, let's understand why finding online hosts is
such a fundamental task in today's interconnected world where networks span vast geographic areas on
the Internet links countless devices.
Being able to identify active machines within a network or on the Internet is crucial.
Penetration testers rely on host discovery to identify potential entry points and vulnerabilities,
while system administrators use it to monitor network health and ensure the smooth operation of their
systems.
Segment two of the Nmap pink scan.
So Nmap pink scan feature takes host detection to the next level by sending a series of probes so the
Nmap goes beyond the icnp echo request commonly used by traditional ping utilities like ping here for
example, pink less pink to ourselves here on our machine.
And as you can see, this is just a pink, right?
So Nmap goes beyond this echo request commonly used like this.
So this comprehensive approach increases the accuracy and reliability of host detection, allowing us
to gather valuable information about the online entities within a target network.
So segment three.
We can execute a ping scan to launch a ping scan with an Nmap.
So we we will utilize this command here.
So this code here, so Nmap scan and here we will enter our target.
Right?
So the SDN here.
Option interacts Nmap to disable port scanning and focus solely on the host discovery phase.
It's worth noting that the Nmap supports a wide range of target specifications, including IP version
four, IP version six addresses, host names and network ranges defined using the wildcards and cedar
notations.
So, for example, to scan the local network, we will first need to understand learn what is the local
network IP starts with here and now.
We will use this Nmap as n here.
192.168.0.
13.1 and 24 here.
So and as you can see now, we are scanning the our Host So segment for analyzing the results.
So once the pink scan is complete, a Nmap provides us with a comprehensive list of hosts that responded
to its probing packets.
So these active machines represent the online entities within the target network segment or the Internet.
So by examining the results, we can gain insights into the network composition, identifying potential
bottlenecks or misconfigurations and further refine our understanding of the target environment.
Segment five uncovering additional details and maps.
Pink scans over more than just the host discovery.
So when executed with sufficient privileges on local Ethernet networks, Nmap can also identify Mac
addresses and associated vendors based on Mac address identifiers.
This additional information allows us to gain insight into the devices present on the network, aiding
in network inventory management and security assessments.
So in order to do that we will just add pseudo before Nmap to run it with pseudo privileges.
And here you will see.
Also the Mac addresses right here.
Segment six Under the Hood How Nmap works to understand the mechanics behind the Nmap pink.
So this pink scans here.
So let's delve into the inner workings of this powerful tool.
This is an option, as mentioned earlier, disables port scanning and focuses solely on the host discovery
interface depending on the user's privileges and Map utilizes various techniques to determine the online
status of a host.
So when executed as privileged users here.
So Nmap employs a combination of techniques, so it sends TCP sync a packet to the port 443 and TCP
acknowledge.
So TCP, TCP, TCP packet to the port 80 and ICMP echo and timestamp requests.
So these the probe helps to ensure that even hosts with restrictive firewall rules can be detected.
So if the user running Nmap doesn't have the capability to send raw packets, it employs the connect
system call to the to send the syn packets on port 80 and port 443.
Segment seven exploring local Ethernet networks.
When scanning local Ethernet networks as privileged users, Nmap activates ARP Neighbor Discovery so
further enhancing host detection capabilities.
So by leveraging ARP request, Nmap can identify Mac addresses and associated vendors.
And this information becomes invaluable in understanding the composition of the network and identifying
the types of devices connected.
So in conclusion, Nmap revolutionizes the way we discover online hosts with its robust pink scan capabilities
and by leveraging Nmap, extensive probing techniques and privileged user functionalities, penetration
testers and system administrators can gain a comprehensive understanding of their networks.
Remember, host Discovery is the first step towards a secure and efficient system.
So go ahead, unleash the power of Nmap and embark your network reconnaissance journey.