>> Welcome to the Nmap lesson on IP/TCP,
UDP, and ICMP headers.
This lesson is simply a brief overview of
the most important TCP/IP protocols you need to
understand when composing Nmap scans.
My main objective will
be to help you to understand the difference
between their headers and
what important features about each you need to grasp.
If you walk away from it with an understanding of
the TCP three-way handshake, encapsulation,
source and destination addresses and ports,
flags and ICMP types and codes, I've done my job.
I'll also provide you with
some good reference videos in case you want
to dive deeper. Let's get started.
In this lesson, we'll talk about two important concepts
in TCP/IP: Encapsulation
and the TCP three-way handshake.
We'll then go on to discuss TCP and examine its header,
then we'll talk about UDP and its header, next,
we'll take a look at the IP header and we'll
finish up with the discussion on ICMP and its header.
In each of these slides,
I'll provide you with some additional
reference material and we'll try to
focus on why and how
this information is relevant to using Nmap.
The more you understand this stuff,
the better you will be in
>> constructing great Nmap scans.
>> Let's talk about two important concepts
in normal TCP/IP communication.
Some of you may be asking why encapsulation and
a TCP three-way handshake are on the same slide.
Well, I have no good explanation except
for the fact that these two concepts are
high level mechanisms that must be understood to
conceptualize what is happening
when Nmap scans are executed.
But the fact is encapsulation
and the TCP three-way handshake are not necessarily
related other than they're both part of
the traditional TCP/IP stack and both fundamental.
Encapsulation is the process of
adding headers and trailers to data.
Many people talk about it in terms of wrappers,
as in candy wrappers,
not like Jay-Z or Eminem.
The idea is that lower layers tack on headers and in
some case trailers to
higher layer packets in
such a way that they are wrapped in them.
The picture on this slide shows
the two most important OSI
or TCP/IP model layers on the left,
as far as Nmap is concerned:
the transport and the network layers.
On the right, it shows which
protocols exist in those layers,
as well as what datagrams are called in each layer.
At the transport layer,
layer 4 of the OSI model,
a datagram is called a segment,
and it can either be TCP or UDP.
At the network layer or layer 3,
a datagram is called a packet.
I wanted to start with this because we're going
to do further analysis of ways that
Nmap uses each of these layers as it
generates its scans by manipulating those headers.
The second concept here is the TCP three-way handshake.
Some of you may be wondering why there is
no UDP handshake on this slide.
The reason is that there is no such thing.
As we discussed in the previous lesson,
UDP does not provide connection-oriented,
aka reliable, end to end communication.
It only provides best effort or
connectionless communication between hosts.
The TCP three-way handshake, on the other hand,
is what makes connection-oriented
>> communication possible.
>> As the picture shows,
user A's computer initiates communication with
server B with a SYN flag set in the TCP segment.
Server B responds with both SYN and ACK flag set,
then user A's computer responds with an ACK.
The connection is established and
communication continues.
This is an important concept in Nmap,
because Nmap and its users, such as you,
can generate scans that manipulate
the TCP flags in different ways in order to
solicit various responses so
you can critically evaluate the results.
This capability is built into
Nmap as a part of its packet crafter called Nping.
If you want to learn more about
encapsulation and the TCP three-way handshake,
I've provided some links to some good videos.
Let's talk about two important concepts
in normal TCP/IP communication.
On the right, I've put a graphic
that lays out the TCP header for you.
TCP is a transport layer,
layer 4 protocol that offers
reliable connection-oriented communication
and is passed down and encapsulated by IP.
From Nmap's perspective, the most important things you
need to understand about the header is its source port,
the destination port, and the TCP flags.
Other things can be altered with Nmap through Nping but
these are the ones you'll spend most
of your time working with in Nmap.
In a regular Nmap scan,
the source port is ephemeral,
meaning your scanning station will automatically
determine the port it opens for
communication and will be
an upper level and non well-known port.
In other words, higher than 1024.
However, the destination port will either be defined by
you and your scan statement or will be chosen by Nmap.
A regular Nmap scan, for instance,
will scan 1,000 popular ports and
a fast Nmap scan will scan 100 of the most popular.
A fast scan is built by using
the -F command line switch
or you can literally
specify exactly the ports you want to scan.
I'll show you this later.
Another great feature of Nmap is that you
don't have to build a full TCP connection,
aka three way handshake when running a scan.
In fact, by default Nmap generates
a TCP SYN scan against targets by
setting the SYN flag but not responding with a SYN-ACK.
This is because the response to SYN scans are
just as reliable as full connect scans,
but are quieter and more polite.
Nmap-sS initiates a SYN scan,
Nmap-sA initiates an ACK scan
and Nmap-sT initiates a full connect scan.
Other important TCP flags to note are U for urgent,
P for Push, R for reset,
and F for finish.
You can also initiate a so-called
>> Christmas tree scan or
>> X-mas scan with a -sX,
which sets all the TCP flags and in doing so,
lights up the TCP segment like a Christmas tree.
Sometimes the responses to
this type of scanning can be valuable,
but they're definitely not quiet.
Some of the same things that apply to
TCP also apply to UDP.
UDP itself is much
simpler with less overhead than TCP, though.
The most important component of
the UDP header is a destination port,
with the ephemeral source port
being supplied by your computer.
It's really important to be familiar with
constructing UDP scans though in
Nmap because some really important services
use UDP for communication.
For example, DNS uses UDP port 53,
NTP uses port 123,
NetBIOS uses port 137,
and LDAP uses 389.
To initiate a UDP scan use an Nmap-sU,
followed by the ports you want to scan
with the -p switch.
I'll show you some examples of this later.
The IPv4 header is tacked on to
the TCP or UDP
header through the process of encapsulation.
IP is connectionless and operates
at layer 3, with the network layer.
You'll notice that I have
version circled in the graphic to the right.
The only reason why I've circled it is
because I don't want you to get confused.
In IPV4 communication,
this value will always be four however,
that doesn't mean that it changes to
six if it is IPV6 communication.
In fact, IPV6 has an entirely different header.
Beyond that, you don't have to
concern yourself with the version field.
The protocol field defines
the protocol that is used
>> in the creation of the packet.
>> For the most part in Nmap,
this will either be TCP or protocol 6,
UDP or protocol 17,
or ICMP or protocol 1.
The source address will usually be your IP address,
though this can be altered and
the destination address is the address of your target.
Nmap-sO allows you to
determine which IP protocols
are supported by target machines.
By default Nmap will scan
all 256 possible protocol values
and provide you with the results.
As with the other slides in this module,
I've provided you with a video
on a deeper look into the IP header,
should you wish to learn more.
The Internet Control Message Protocol
is used all around the world by
network analysts to determine
if packets are routing successfully,
if hosts are up and running
and for simple latency analysis.
This is done using the ping or
traceroute command in your favorite operating system.
ICMP is really a supporting protocol
and acts similar to layer 4 protocols,
but really exists in layer 3 technically.
As you'll notice in the graphic though,
ICMP must be attached to
IP because it has no address field in its header.
The two most important fields in
the ICMP header are type and code.
If you look at the graphic,
you'll notice many familiar responses
with most of them being type 0,
3, 8 or 11,
like destination host unreachable and TTL exceeded.
The biggest thing I want to point out is
the fact that when you read about
ping scans in Nmap do not assume
that this means ICMP is being used.
In fact, ICMP is really only used as
a helper utility to
traditional TCP and UDP scans in Nmap.
In fact, in order to initiate an ICMP scan,
you have to run Nmap-sn-PE.
Nmap can use ICMP in novel ways though, for instance,
you can construct small ICMP packets that solicit
responses from entire networks very quickly in Nmap.
This is much more effective than simply running
a ping command one at
a time to every device on the network.
However, I think you'll see that using
TCP and UDP scans are much more
effective and allowing Nmap to use
ICMP as a helper is usually the best bet.
In this lesson, we discussed
two important concepts in TCP/IP:
>> encapsulation and the TCP three-way handshake.
>> We then discussed TCP and examined its header,
then we talked about UDP and its header,
next we took a look at the IP header and
we finished up with a discussion
>> on ICMP and its header.
>> I hope you found this information very helpful.
Thank you so much for walking through it with me.
I'll talk to you more in the next lesson.