>> Now we'll do some UDP scans.
I just wanted to tell you that UDP
>> scans do take longer,
>> so I'll try to minimize
the number of ports that we scan here,
but feel free to test it on your own.
[BACKGROUND] Syntax is using
a -sU, and then the rest of it is the same -p,
space, and then the port number.
As I've told you before,
I like to put the target at the end.
That was pretty quick scan,
really, even though it was UDP.
Port 53 is open on UDP which is a DNS.
We'll do a clear screen, and I'll do a -sU,
-p. We'll do multiple UDP ports this time.
[BACKGROUND] I don't know if you noticed,
but I'm choosing ports that I know
responded in previous scans, so hit "Enter."
This one responded, I think,
but I know rpcbind can be found on Windows Server.
I wanted you to also see that the
>> statement here is open
>> filtered, and 111 is closed.
It's really good information.
Right now I'll do a nmap -sU.
[BACKGROUND]
This one takes
a little bit of time, so I'll go ahead and run it.
The main point here was to show you again that you
can separate your ports by a comma,
but then you can also do a range.
You could do the range first, and
then a comma, and then specific ports
if you want, or vice versa.
There's a lot of flexibility here in nmap.
I entered to see the status.
I'm going to go ahead, and cancel this scan because I
don't want to make this lab longer than it needs to be.
You get the point I think.
I hit the "Control C" clear the screen again.
Again, I wanted to show you that you could do
a name service scan,
which is like a nmap -sU.
The same with TCP,
you can specify it by the names of the services.
We see port states of open
filtered, and closed on
these services and these ports, and they're all UDP.
I think you get the point there.
Now I want to show you how to do
TCP SYN and UDP scans of
>> specific target, specific ports.
>> We'll do a nmap -sS -sU,
will do a fast scan.
Actually I think I might have already
shown you this scan.
But again, the main point is if you include -SU,
which is UDP scan,
but you also want a TCP scan,
you have to specify it.
Otherwise it'll only scan UDP.
I think I already showed you, so I'm going
to cancel that one.
We'll do a nmap -sS -sU,
>> this should go fast.
>> The scanning TCP, and UDP ports 53.
The reason why I chose 53, is because that's DNS.
DNS server, and client uses port 53.
I knew that those ports would be opened on
this Windows 2012 server box.
We'll do a nmap -sS -sU.
This scans a couple of different TCP,
and UDP ports specified here.
The -p and then followed by the port numbers
here means that since
I'm doing a SYN scan, and a UDP scan,
it's going to scan these ports
of both of those types of scans.
The reason I'm pointing that out is because
in a minute I want to show you how you can
specify different TCP ports then UDP ports.
Hit "Enter", there you go.
There's the results, you can see all of the UDP port
scanned, and their names.
Which ones are open, and then
the TCP ports scanned, and their status,
>> and their names.
>> I'll clear the screen. Here's where
the rubber hits the road I guess in some ways.
We'll do a scan that
scans different TCP ports, and UDP ports.
We'll do a nmap, just like the other ones -sS -sU,
the syntax is T, and then a comma right afterwards.
You see what I've done here.
Here's the port. We already know that we're
doing TCP, and UDP scan.
Separate it with a space,
>> and then with a capital T colon,
>> the TCP ports I want to scan,
comma, UDP ports followed
by a colon, and then the range in this case.
This might take a little bit of time to run.
[BACKGROUND]
There's the results.
You see the open TCP ports, and
the open UDP port now have been filtered UDP port.
The main point there was just to show you how
to do both at the same time and
show you that the same flexibility
from earlier scans applies
to when you want to do specific
>> TCP ports, and UDP ports.
>> This is the last one,
and I just want to show you the flexibility of Nmap.
The target is the same,
both SYN scan, and a UDP scan.
But notice that I put names of
services and numbers in there too.
I could even modify this if I wanted to, and
add additional TCP ports, let's say 3389.
The point is you can put numbers,
or you can put the names.
That's a fast scan, so that's end of this lab.
Just remember, with almost every scan that you run,
you can choose the TCP, and UDP ports that are
scanned, and leave those that you aren't interested of.
The most important part to remember is
the dash P followed by the port designation.
The second most important part is to remember that
in order to do a TCP, and UDP scan,
you have to specify the type of TCP scan to
run along with the dash S capital U.
If you only put a dash S capital U,
only a UDP scan will occur. Thank you so much.
In this lesson, we learned about the following: First,
we talked about what port scanning is.
Next, we discussed the different port states
recognized by Nmap.
Then we determined
>> why we scan ports in the first place.
>> Then we applied that knowledge by
talking about how port scanning is
performed in Nmap, and work through
several examples in the lab.
Thanks so much for working through this lesson
with me and I'll talk to you again in the next one.