Port Scanning Basics

Cyber Security
#1

A port scanner sends a TCP or UDP network packet and asks the port about their current status. The three types of responses are below:

  1. Open, Accepted: The computer responds and asks if there is anything it can do for you.
  2. Closed, Not Listening: The computer responds that “This port is currently in use and unavailable at this time.”
  3. Filtered, Dropped, Blocked: The computer doesn’t even bother to respond.

Port scans generally occur early in the cyber kill chain, during reconnaissance and intrusion. Attackers use port scans to detect targets with open and unused ports that they can repurpose for infiltration, command and control, and data exfiltration or discover what applications run on that computer to exploit a vulnerability in that application.

Ping Scanner

The simplest port scans are ping scans. A ping is an Internet Control Message Protocol (ICMP echo request – you are looking for any ICMP replies, which indicates that the target is alive. A ping scan is an automated blast of many ICMP echo requests to different targets to see who responds. Ping scans aren’t technically port scanning techniques, as the best you can get back is that there is a computer on the other end, but it’s related and usually the first task before you do a port scan.

TCP Half Open

One of the more common and popular port scanning techniques is the TCP half-open port scan, sometimes referred to as an SYN scan. It’s a fast and sneaky scan that tries to find potential open ports on the target computer.

TCP Connect

This port scanning technique is basically the same as the TCP Half-Open scan, but instead of leaving the target hanging, the port scanner completes the TCP connection.

It’s not as popular a technique as the TCP half-open. First, you have to send one more packet per scan, which increases the amount of noise you are making on the network. Second, since you complete the target’s connection, you might trip an alarm that the half-open scan wouldn’t.