Slashdot Mirror
Nmap Network Scanning
brothke writes "The 1962 song Wipe Out,
with its energetic drum solo started, was the impetus for
many people to take up playing the drums. Similarly,
Nmap, the
legendary network scanner, likely interested many in the art of hacking, and
for some, started a career for security professionals and
hackers. Nmap and its creator
Fyodor
need no introduction to anyone on Slashdot. With
that, Nmap Network Scanning: The Official Nmap Project Guide to
Network Discovery and Security Scanning, is a most useful
guide to anyone interested in fully utilizing Nmap." Read on for the rest of Ben's review.
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
author
Gordon Lyon (Fyodor)
pages
468
publisher
Nmap Project
rating
9
reviewer
Ben Rothke
ISBN
978-0979958717
summary
Valuable book about an invaluable security tool
One may ask, why spend $50 on this book, when the
Nmap Reference
Guide provides a significant amount of the basic
information needed to use the tool, especially since the reference guide is
both free, and well written. The reference guide is
included in the book in chapter 15, and takes up 41 pages.
And for those that are cash strapped, the free reference guide is
the way to go.
In addition, the web site for the book notes that about half of the content is available in the free online edition. The most useful information is in the book in chapters exclusive to the print edition, which includes Detecting and Subverting Firewalls and Intrusion Detection System, Optimizing Nmap Performance, Port Scanning Techniques and Algorithms, Host Discovery, and troubleshooting.
The main benefit of the buying the book is that it has the collected wisdom of Fyodor's, in addition to numerous real-world scenarios, and Nmap commands not documented elsewhere. At over 400 pages, the books 15 chapters provide the reader with everything they need to know about using Nmap to the fullest.
Chapter 1 starts with an overview of the history of Nmap and how it came to be. As to the question of whether port scanning is legal, the author writes that it is best to avoid the debate and its associated analogies. He advises that it's best to avoid ISP abuse reports and criminal charges, by not annoying the target network administrators in the first place. Chapter 1 provides a number of practical suggestions on just how to do that.
A complaint against Nmap it that is has often been blamed for crashing systems. Chapter 1 shows that the reality is that Nmap will rarely be the primary cause of a system crash. The truth is that many of the systems that crashed as a result of an Nmap scan were likely unstable from the outset, and Nmap either pushed them over the top or they coincidentally crashed at the same time as the Nmap scan.
An ironic incident detailed in chapter 3 is when someone from the information security department of Target Corp. complained to the author that he felt the Nmap documentation was particularly directed at his organization; given the use of the term target. He requested that the Nmap documentation be changed from targetto example. The section on target enumeration in the book shows the author did not take that request to heart.
Another example of where the book goes beyond what is in the reference guide is where the author shows the most valuable TCP ports via his probe of tens of millions of IP addresses across the internet. Not surprisingly, ports 80 23 and 443 were the top three most commonly open TCP ports. It is surprising that other ports, which should have been secured long ago, are still as vulnerable as ever.
For the serious Nmap user, the book is worth purchasing just for the indispensable information in chapter 16, which is about optimizing Nmap performance. The author writes that one of his highest priorities in the creation of Nmap has been performance. Nmap uses parallelism and numerous advanced algorithms to execute its blazingly fast scans. This chapter shows how to create Nmap commands to obtain only the information you care about and significantly sped up the scan. The chapter details numerous scan time reduction techniques, and strategies on how to deal with long scans. The chapter concludes with the output of a user who, with a customized Nmap command, was able to reduce his scan of a 676,352 IP address network from nearly a week to 46 hours.
Chapter 10 is also a fascinating chapter on the topic of detection and subverting of firewalls and IDS. The function of such tests on an internal network is to help an organization understand the dangers and risks of a real attack. Since it is not uncommon for firewalls to be accidentally misconfigured, or have rule bases that leak from far too many rules; such a test can be quite useful to any network.
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning is the guide for anyone who wants to get more out of Nmap. It is useful whether one is a novice and only getting into basic security testing, or an advanced user looking for ways to optimize Nmap.
The book takes a real-world approach on how to use the tool and clearly documents every Nmap feature and option. It also shows how the tool should be correctly used in various settings.
What is unique about is that this is a rare book in which the creator of the program wrote it. Linus Torvalds never got around to writing a Linux reference, nor did the creators of the Check Point firewall. In Nmap Network Scanning, the reader gets the story from the creator of the code itself. This then is the ultimate Nmap reference guide.
Aside from the history and use of the program in the first chapter, the rest of the book is an extreme guide to maximizing the use of Nmap. It is written by a programmer and written for the technically astute. Anyone who wants to maximize their use of Nmap will find no better reference.
Ben Rothke manages the Bright Hub Enterprise Security channel and is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
In addition, the web site for the book notes that about half of the content is available in the free online edition. The most useful information is in the book in chapters exclusive to the print edition, which includes Detecting and Subverting Firewalls and Intrusion Detection System, Optimizing Nmap Performance, Port Scanning Techniques and Algorithms, Host Discovery, and troubleshooting.
The main benefit of the buying the book is that it has the collected wisdom of Fyodor's, in addition to numerous real-world scenarios, and Nmap commands not documented elsewhere. At over 400 pages, the books 15 chapters provide the reader with everything they need to know about using Nmap to the fullest.
Chapter 1 starts with an overview of the history of Nmap and how it came to be. As to the question of whether port scanning is legal, the author writes that it is best to avoid the debate and its associated analogies. He advises that it's best to avoid ISP abuse reports and criminal charges, by not annoying the target network administrators in the first place. Chapter 1 provides a number of practical suggestions on just how to do that.
A complaint against Nmap it that is has often been blamed for crashing systems. Chapter 1 shows that the reality is that Nmap will rarely be the primary cause of a system crash. The truth is that many of the systems that crashed as a result of an Nmap scan were likely unstable from the outset, and Nmap either pushed them over the top or they coincidentally crashed at the same time as the Nmap scan.
An ironic incident detailed in chapter 3 is when someone from the information security department of Target Corp. complained to the author that he felt the Nmap documentation was particularly directed at his organization; given the use of the term target. He requested that the Nmap documentation be changed from targetto example. The section on target enumeration in the book shows the author did not take that request to heart.
Another example of where the book goes beyond what is in the reference guide is where the author shows the most valuable TCP ports via his probe of tens of millions of IP addresses across the internet. Not surprisingly, ports 80 23 and 443 were the top three most commonly open TCP ports. It is surprising that other ports, which should have been secured long ago, are still as vulnerable as ever.
For the serious Nmap user, the book is worth purchasing just for the indispensable information in chapter 16, which is about optimizing Nmap performance. The author writes that one of his highest priorities in the creation of Nmap has been performance. Nmap uses parallelism and numerous advanced algorithms to execute its blazingly fast scans. This chapter shows how to create Nmap commands to obtain only the information you care about and significantly sped up the scan. The chapter details numerous scan time reduction techniques, and strategies on how to deal with long scans. The chapter concludes with the output of a user who, with a customized Nmap command, was able to reduce his scan of a 676,352 IP address network from nearly a week to 46 hours.
Chapter 10 is also a fascinating chapter on the topic of detection and subverting of firewalls and IDS. The function of such tests on an internal network is to help an organization understand the dangers and risks of a real attack. Since it is not uncommon for firewalls to be accidentally misconfigured, or have rule bases that leak from far too many rules; such a test can be quite useful to any network.
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning is the guide for anyone who wants to get more out of Nmap. It is useful whether one is a novice and only getting into basic security testing, or an advanced user looking for ways to optimize Nmap.
The book takes a real-world approach on how to use the tool and clearly documents every Nmap feature and option. It also shows how the tool should be correctly used in various settings.
What is unique about is that this is a rare book in which the creator of the program wrote it. Linus Torvalds never got around to writing a Linux reference, nor did the creators of the Check Point firewall. In Nmap Network Scanning, the reader gets the story from the creator of the code itself. This then is the ultimate Nmap reference guide.
Aside from the history and use of the program in the first chapter, the rest of the book is an extreme guide to maximizing the use of Nmap. It is written by a programmer and written for the technically astute. Anyone who wants to maximize their use of Nmap will find no better reference.
Ben Rothke manages the Bright Hub Enterprise Security channel and is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
An ironic incident detailed in chapter 3 is when someone from the information security department of Target Corp. complained to the author that he felt the Nmap documentation was particularly directed at his organization; given the use of the term target.
He requested that the Nmap documentation be changed from target to walmart
Free Martian Whores!
I always roll my eyes when I hear someone complain about nmap "crashing a system". This should be common sense. If the target crashed simply from being nmapped or scanned from the outside - the target is obviously a turd of a system.
Just disrupt the deflector shield with a tachyon burst.
my school's IT department confused my port scanning with that of a virus and subsequently banned me from the network.
Chapter 1 starts with an overview of the history of Nmap and how it came to be.
Trivia: I remember clearly reading nmap's introduction to the world in Phrack issue 51 "The Art of Port Scanning" more than 10 years ago.
(And it's cool to see Phrack is still still around!)
I suspect a lot of slashdot readers are too new, have forgotten, or never learned of Fyodor's slashdot "girlfriend". Long story short -- a dude posted on slashdot, claiming to be a girl. Fyodor tried to hook up with "her" and "she" strung him along for awhile. After discovering "she" had dude parts, Fyodor hacked his computer and posted screenshots.
Do you even lift?
These aren't the 'roids you're looking for.
Damn dude, just link people to the clip...
http://www.youtube.com/watch?v=ojFFS_T3UQk
while mostly being a steaming pile of shit compared to the original, it attempts to redeem itself by accurately using nmap in one scene
http://www.theregister.co.uk/2003/05/16/matrix_sequel_has_hacker_cred/
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
...to know that I wanted to play drums!
NMap is the best there is, period. There's not even specialist scanners that can up it's features, especially since you can set packet flags manually in the more recent versions. It really, really fills it's niche. I use it all the time in my daily life just for benign remote service discovery, and I assume many people do too. I've never had anyone complain about it either.
Have they included a network mapping function yet? They announced it as a GSoC project last year I think, did they get around to hack some graphical map output?
One of the boooks are writting visual basic that I learned from actually used making a port scanner as a learning project. Which I thought was kind of funny, but I did learn the basics of networking.
When I was a boy the goverment stole everything from us.
It's a troll.
"I was definitely pretty excited when I saw it," says "CmdTaco," the 25-year-old openly gay author of Nmap.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Nobody claimed that nmap was the first port-scanner. Oh, and wow, VisualBasic.
The system crashing is not a bug.
It is a feature.
Reply to That ||
Henceforth to be known as "Wal-Ware".
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
I thought I was not reading correctly, but... 468 pages on a single book about nmap?
I'd prefer [code]# nmap -h (or --help)[/code] it would give me the same results. JESUS! people became crazy... 468 pages?!!?!?! Nmap?!?!?!
Read and Comment at my BLOG
!!!
This is tangentially related, but it sort of fits in with the idea of "cools ways to use nmap" -- or, in this case "things you can't do with nmap".
While setting up a 6to4 tunnel to give my home LAN IPv6 access (just for fun), I decided to use nmap to scan my home IPv6 network. I've used nmap from time to time to portscan, but mostly I use it as a ping scanner, just to find live hosts, so it seemed like a natural way to find out which hosts had picked up IPv6 addresses.
I first tried the obvious syntax "nmap -sP <my subnet prefix>::/64", but nmap told me that slashes are not allowed, and that "IPv6 addresses can currently only be specified individually".
My first reaction was "Well, that's stupid. Why can't nmap handle IPv6 subnets? Idiots". However, a half-second later it occurred to me that I was the idiot: what I thought I wanted nmap to do was to scan 18,446,744,073,709,551,616 addresses. That's obviously impractical. That many requests would saturate a 10 Gbps network for 60,000 years (2^64 128-byte packets).
So, FYI, if you want to find out what hosts are live on your IPv6 network, the way to do it is to ping the link-local multicast address (fe02::1). Assuming they're not firewalled, all of the hosts will answer. Of course, what you'll get back is their link-local addresses, not their routable addresses. I haven't found a convenient way to get a list of those, other than a little sed script to convert the link-local addresses to their equivalents in the subnet.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Whiskey Tango Farva? Not to put Nmap or Zenmap down, but WTF? If I've missed something and Fyodor is entitled to a multi-page ad, I apologise.
http://slashdot.org/comments.pl?sid=37682&cid=4037364
http://slashdot.org/~sllort/journal/33255
If we don't fight for ourselves no one will.
so what?
what did u do more than that?
maybe that is why a 100 million people use nmap and not yer tool.
Not perfect behaviour but is that bit of tresspass really that bad? IMHO it's about thirty notches down the "black hat" scale less nasty than spammers that pretend to send things from your email address. I like it as a nice little anecdote to tell people to have decent firewall rules (and not have unsecured MS Windows machines naked to the net).
what's this got to do with the book review?
and your point is what?
Um, sllort is a known troll account who regularly makes up stories. His username is 'trolls' spelled backwards, and you call sllort's page of speculation a credible citation? It is possible that some parts of the story are true, but you have still been trolled.
nmap is way cool, infact so cool I am surprised it is legal, heh ;P Thank you & kudos to you Fyodor for your expertise and generosity, truly brilliant and inspirational stuff.
nmap is way cool, infact so cool I am surprised it is legal, heh ;P Thank you & kudos to you Fyodor for your expertise and generosity, truly brilliant and inspirational stuff.
I tried using Nmap to find open FTP servers on a class B address. It's all fun and games until you try it on a class B. Just do class C at most. Class C will probably still piss off enough people to get you in trouble, and thats only scanning one port.
How can someone call the reference guide well written, then five sentences later say that the book explains commands not documented elsewhere? Isn't the purpose of the reference guide, manpages, and any other documentation to define _all_ of the commands that are inserted into a program?
Now, I have to question what _else_ has been put into the program that hasn't been documented. Unfortunately, this lends credibility to Fyodor's detractors, and raises questions for me as to whether nmap belongs on my computer at all. (As a network professional that has rights to portscan his network it is a useful tool.)
Let me add a minor correction to the description:
Well at least it's a new one.
To have a right to do a thing is not at all the same as to be right in doing it
what's this got to do with the book review?
You've never meet a troll have you?
Shoot Yourself In the Foot