Well, what do open, closed or filtered actually means?
Let's take a closer look at the results of unmap when A sends packets to a port and receives a positive
response.
The port is assigned the state of open, for example, since Gane receives a Sinak from the destination
system if the port is open.
If Unmap determines that a port is not available, it assigns it the closed state, this signifies it,
and MAP has received a result that clearly shows that the port is closed.
A sin scan receiving a receipt in response to a port query is an example of a closed port.
Filtered ports are the result of a packet filter or firewall when no response at all is received from
the remote device.
The port is considered to be filtered.
A response isn't received from the port and map of an retries communication to the port to ensure that
the packet wasn't simply dropped due to error or congestion.
Please note that this type of response is categorized differently.
If this is a different scan type, such as a UDP scan or a fin scan, the next result, open filter
is coming in a minute.
On the other hand, if the destination systems return, an unexpected response.
Again, the port is considered to be filtered.
If we get an ICMP unreachable response in a sense scan, the port is flagged as filtered.
Now, in some cases, the lack of a response may not necessarily mean that a port is filtered.
Lack of a response might mean that the port might also be open now in these situations, and map signifies
that the port is either filtered or open, for example, in a UDP connection.
In most cases, the destination system does not send a response when it receives a UDP packet.
So if the destination system does not respond and map categorizes it as open, filtered makes sense.
In this slide, you see some of the most known default ports.
So here's a question, if the Port 22 is open, is the service running there?
Absolutely.
And S.H., could there be another service?
Well, these are the default port numbers of the services.
You can run any service in any port.
You can run HTP on board 22, for example.
But for the ease of use, the default ports are used in general.
So if you're performing a test, you should probably look at the well-known ports first, but you should
never just scan the default ports.
There are different ways to scan ports with a map.
Let's see how we can scan ports.
Let's prepare a second scan for him, Métis portable device, the IP address of my meds voidable is
one seven two one six eight nine nine two zero six.
If you do not use any one of the port scanning parameters, top 1000 ports are scanned, top ports are
the most used ports in general.
The first way of choosing the ports to scan is using parameter.
After entering the scanned type and target IP.
Enter the port numbers with parameter.
You can at reports one by one, separated by a comma, or you can give a range of ports by putting a
dash between the port numbers.
In this example, the ports, 20 to 80 and the ports between 100 and 200 are scanned.
If you perform both TCP scan and UDP scan in a single and map query.
You can choose both the EDP boards and the TCP boards using parameter.
Where they send maps, scan will use both since scan and UDP scan at the same time, we haven't seen
it yet, but the UDP scan is performed using s capital you parameter.
And as you know, the cities scan is a type of TCP scan.
After entering the target IP put Desh P.
One or TCP words put uppercase T with a colon just after the parameter P and the T seaports to scan.
Sam is giving port numbers directly with parameter, you can enter ports one by one, separated by a
comma, or you can give a range of ports by putting a dash between the port numbers.
To specify the UDP reports put you as another case, you with a colon and the ports with the same format.
For this example, let's scan the TCP ports to an 80 and the UDP ports 53 and the ports between 139
and 150.
So here are the results, TCP ports first and then UDP ports.
Now, the way to specify the ports is using top ports parameter, using this with the number of ports
that will be scanned, you can scan the top ports within this parameter.
So let's scan top 20 ports for this example.
So here are the top results of the most used 20 ports.
If you use uppercase F, which means fast scan top 100 ports or scan.
So let's perform an end map since scan with a parameter here.
And open another terminal screen and perform another and map scan using top ports 100 parameter.
As you see, we get the same result because these are the same queries.
If you'd like to scan all the parts of the system.
Well, you should scan all the ports of the systems and append test, you have to use the parameter
with the interval from one to 65, 535.
This is a range of possible port numbers.
Prepare the maps and scan Creary with the destination IP address now put P one dash six five five three
five.
And hit enter.
Here are all the open ports of medicine voidable.
By default and MAP does host Discovery and then performs a port scan against each host it determines
is online.
If you use P N in the N McCreery, you skip host Discovery and Port, Skåne, all target hosts.
Disabling host discovery with poison causes and map to attempt the requested scanning functions against
every target IP address specified.
So if Class C target address space, that means 24 is specified on the command line, all 255 IP addresses
are scanned.
Why would we want to do this?
As you know, if you were a privileged user and MAP sends four types of packets to discover hosts ICMP
Echo Request Send Packet to TCP 443 Port.
Backpacked packett to TCP Port and ICMP timestamp request.
If a system is configured not to answer to ICMP request and if the ports 80 and 443 are filtered, then
that map thinks that the host is down even if it's up.
If you find a system which is not found by pings, can always use -- for further port scans otherwise.
And MAP doesn't perform the ports scan because it assumes that the host is not up.
So if your network is not big or if you don't have enough time to scan, you should skip the ping scan
and run the port scans for every possible IP address.
Use a sports fan instead of ping scan, if you were scanning a server block, because those systems
are configured to be more secure than usual.
Then you can find more computers than the ping scans do.
You're halfway there.