Lecture Notes: Nmap and Packet Analysis

Introduction

• Hosts: David Bomble and Chris
• Topic: Security and Nmap tool exploration
• Chris recently passed the Certified Ethical Hacker (CEH) certification

Certified Ethical Hacker (CEH)

• Chris shared his learning experience with CEH, especially useful for those with a packet background.

Nmap Overview

• What is Nmap?

  • Network Mapper tool for discovering devices and services on a network.
  • Used for scanning networks to identify open ports and operating systems.
  • Essential tool for both internal pen testing and inventorying devices.

• Nmap Switches and Options

  • Host Discovery
  • Target Specifications
  • Scan Techniques
  • Port Specification
  • Service Detection
  • OS Enumeration

Scan Techniques

• TCP Syn Scan (Stealth Scan) - -sS

  • Known as a half-open scan.
  • The client sends a SYN packet, receives a SYN-ACK, but then sends a RST instead of an ACK.
  • Used to determine open ports without completing the TCP handshake.
  • Historical reason: Thought to evade logging on systems.

• TCP Connect Scan - -sT

  • Completes the TCP handshake.
  • Full connection established (SYN, SYN-ACK, ACK) and then a RST is sent.
  • Uses the OS's TCP stack for generating packets.

Packet Analysis with Wireshark

• Using Wireshark to Analyze Scans

  • Capture packets while using Nmap for practical learning.
  • Identify unique packet headers in stealth and connect scans.
  • Stealth Scans: Smaller TCP window size (1024 bytes), limited TCP options.
  • Connect Scans: Use full TCP windows and options, resemble normal traffic.

• Filtering and Identifying Scans

  • Use Wireshark filters to identify suspicious traffic.
  • Example filters based on TCP window sizes and header lengths.
  • Conversation Completeness: Wireshark feature to evaluate the extent of TCP conversations (e.g., handshake, reset scenarios).

Practical Tips for Packet Analysis

• Efficient Packet Capturing

  • Use command-line tools like dumpcap for capturing large amounts of data.
  • Implement ring buffers to capture data efficiently: smaller, manageable file sizes.

• Troubleshooting Techniques

  • Use bookmarks in traffic captures to pinpoint events.
  • Employ tools like tshark for handling large PCAPs.

Real-World Application

• Security and Network Monitoring
  • Recognizing patterns and anomalies in network traffic to detect unauthorized scans.
  • Importance of understanding packets for cybersecurity.

Conclusion

• Learning and Understanding
  • Seeing protocols at the packet level enhances understanding of cybersecurity tools and techniques.
  • Encouraged continued exploration of network protocols and packet analysis.

Future Content

• Plans for further videos covering TCP, UDP, and other protocols.
• Audience encouraged to suggest topics for future discussions.

Chris and David emphasized the importance of practical application and understanding of network tools like Nmap, particularly through detailed packet analysis using Wireshark. The session highlighted key techniques, differences in scanning methods, and effective ways to capture and analyze network traffic.