Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 69)

22/tcp open ssh

25/tcp open smtp

37/tcp open time

53/tcp open domain

80/tcp open http

3000/tcp open ppp

Nmap run completed −− 1 IP address (1 host up) scanned in 2 seconds

If you've read most of this document, you should be familiar with these services by now. These are some of

the same ports we've seen in other examples. Some things to note on this scan: it only did 1500+

"interesting" ports −− not all ports. This can be configured differently if more is desirable (see man page). It

only did TCP ports too. Again, configurable. It only picks up "listening" services, unlike netstat that shows

all open ports −− listening or otherwise. Note the last "open" port here is 3000 is identified as "PPP". Wrong!

That is just an educated guess by nmap based on what is contained in /etc/services for this port

number. Actually in this case it is ntop (a network traffic monitor). Take the service names with a grain of

salt. There is no way for nmap to really know what is on that port. Matching port numbers with service

names can at times be risky. Many do have standard ports, but there is nothing to say they have to use the

commonly associated port numbers.

Notice that in all our netstat examples, we had two classes of open ports: listening servers, and then

established connections that we initiated to other remote hosts (e.g. a web server somewhere). nmap only

sees the first group −− the listening servers! The other ports connecting us to remote servers are not visible,

and thus not vulnerable. These ports are "private" to that single connection, and will be closed when the

connection is terminated.

So we have open and closed ports here. Simple enough, and gives a pretty good idea what is running on

bigcat −− but not necessarily what we look like to the outside world since this was done from localhost, and

wouldn't reflect any firewalling or other access control mechanisms.

Let's do a little more intensive scan. Let's check all ports −− TCP and UDP.

# nmap −sT −sU −p 1−65535 localhost

Starting nmap V. 2.53 by [email protected] ( www.insecure.org/nmap/ )

Interesting ports on bigcat (127.0.0.1):

(The 131050 ports scanned but not shown below are in state: closed)

Port State Service

22/tcp open ssh

25/tcp open smtp

37/tcp open time

53/tcp open domain

53/udp open domain

80/tcp open http

3000/tcp open ppp

8000/tcp open unknown

32768/udp open unknown

Nmap run completed −− 1 IP address (1 host up) scanned in 385 seconds

Security Quick−Start HOWTO for Red Hat Linux

8.7. nmap 66

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 69