‫Active scanning is done through sending multiple probe requests and recording the probe responses.
‫Because passive scanners are limited to looking at existing traffic, they suffer in terms of overall
‫completeness and accuracy.
‫For example, a passive scanner can't detect an application that no one ever uses, and it can be fooled
‫easily by a system intentionally spewing out misinformation and disinformation.
‫The all seen on this slide are a few examples of active scanning tools in this course, we will examine
‫the end map and NASA's tools in detail.
‫HP is an excellent command line oriented TCP IP Packet Assembler Analyzer.
‫The interface is inspired by the Ping eight Unix command, but each ping isn't only able to send ICMP
‫Echo requests.
‫It supports TCP, UDP, ICMP and raw IP protocols as it trace root mode, the ability to send files
‫between a covert channel and many other features.
‫So a subset of the stuff you can do using a jumping.
‫Firewall testing.
‫Advanced port scanning network.
‫Testing using different protocols to use fragmentation.
‫Manual path to Discovery advanced trace route under all the supported protocol, remote O.S. fingerprinting,
‫remote uptime guessing.
‫And don't forget, TCP IP stacks auditing.
‫It can also be useful to students that are learning TCP IP, although it's a packet analyzer tool.
‫It's widely used for D.O.C. denial of service tests and attacks to create IP spoofed packets and send
‫them to the target system.
‫Let's see how we can use the shipping command to scan the network, simply go to Carly and open a terminal
‫screen.
‫Each being three is embedded in the collar and defined in the path, so you can use it anywhere.
‫Just typing the name of the command age being three.
‫Type each ping three, dash each or each ping three dash help to see the detailed usage of the Ping
‫three command.
‫Let's look at a few parameters important first canning mode.
‫Under the mod title, we have a scan mode, and the help shows a sample usage of the mode as well.
‫We'll use scan or eight parameter to use each being in scan mode.
‫Under TCP UDP title.
‫We have the parameters to set the flags of TCP or UDP packet.
‫Well, you'll see the flags and meaning in this course and following lectures, so just see the shipping
‫in action now.
‫For example, uppercase s or sin parameter is used to set the sin flag of TCP or UDP packets.
‫Let's prepare the age bin command to make a network scan, the first parameter is scan to use a ping
‫in scan mode.
‫Here, we should say in which ports we will scan in this example, zero to 500 means that the ports
‫between zero and 500 will be scanned.
‫You can give a port range like this with a dash between the lower bound in the upper bound.
‫Or you can give the ports one by one separating them by a comma.
‫Or you can use a combination of these two.
‫Now I want to set the scene flag of the pack because all TCP connections start with a signed packet.
‫Well, again, we'll show you how a TCP handshake is made later on in the following lectures.
‫Here comes the IP address to scan.
‫Hit enter to start the scan.
‫Here we have the responding ports and the flags column says what the reply is, we sent send packets
‫and get send act packed.
‫That means ports are accessible and open to us.
‫Now, let's make another scan.
‫This time, I'll use Uppercase X to make a Christmas scan, and this can push urgent, and Finn flags
‫are set in the packet, which is not seen in regular traffic.
‫Since the packets they received are not valid packets, they've dropped them.
‫And returned no response.