Port scanning is the act of systematically scanning a computer’s ports. A port on a computer is a place where information goes into and out of the computer and port scanning identifies the status of any of these ports.
Port scanning has legitimate use in network management but it can also be used in a malicious nature if an attacker is looking for weakened access point to break into a computer. Usually services running on these ports broadcast version and other information about itself for troubleshooting and other kinds of uses but this also gives a lot of information to the would be attacker.
Type of port scans
Vanilla
This type of scan attempts to connect to all known 65,535 ports
Strobe
This is a more focused scan and looks for only known services to exploit
Fragmented Packets
This type of scan sends packet fragments that get through simple packet filters in a firewall and later joined back together at the target
UDP
This type of scan looks for all open UDP ports
Sweep Scan
This kind of scan connects on the same port on more than one machine for example looking for any FTP servers an attacker would do a sweep scan for port 21 over a range of given network machines
Stealth scan
This kind of scan prevents the scanned computer from recording the port scan activities, this is due to the structure of the request sent by the port scanner.
Tools of the trade
The most popular tool for port scanning is nmap and provides a wide variety of options of performing different kind of port scans like stealth scans and many more. Its modular architecture has also enabled development of plugins that have expanded its capabilities
Defence
These attacks can now be easily detected by firewalls and intrusion detection systems. Current intrusion detection systems like snort can at times frustrate the attacker by dropping packets used in scanning giving the port scanning tools false positives.
Some other way of defeating the port scans is to install services on ports other than the default ports and also to disable display of service banner information to stop any finger print scans
Port scanning is not illegal per se but is most times indicative of beginnings of an attack hence measure have to be taken to secure any internet facing devices.
