Nmap Scan Types: How to Scan a Server’s Network

In server security, you often need to perform a regular audit of your server, or one belonging to someone else to see what devices are connected to it. In this context, “devices” doesn’t just mean peripherals like keyboards, mice etc, which in any case are irrelevant for most servers, but also mounted devices, open ports, services, network printers, and more. Nmap allows you to get a “map” of all the network devices on a server, so you can see what’s available. But why would you want to generate such a map in the first place?

What’s the Reason for Using nmap?

Presumably, if you own and operate the server in question, you already know what the network configuration is like, right? After all, if there’s a web server, or SSH, a mounted drive or something else, you would have been the one to set those up. So why would you need to use nmap on your own server? Is it to be used only when you’re arriving at a new server to take management and need to perform a security audit?

The truth is that nmap is an invaluable tool even for servers that you own. Servers are notorious for something known as “configuration drift”. This is a process that happens over time, and refers to the manner in which a server can accumulate “debris” or experience signification changes in the way in operates. New devices are added and removed, and the server itself might end up performing a role for which it was never designed. In such situations, you should periodically take stock to see what the new map of the server is like as part of a regular security audit.

How to Use nmap

On Ubuntu systems, nmap is often not installed by default, so you install it via:

sudo apt-get install nmap

Once it’s installed, you can start scanning systems.

Ethically Scanning Vulnerable Test Systems

Because nmap can scan a remote server using just the IP address, it’s important to test it ethically. Luckily, the Nmap Security Scanner Project has set up a test server that’s left deliberately vulnerable, so you can test the nmap command on it without worrying about being flagged as a security threat. The server is:

http://scanme.nmap.org/

Keep in mind that using nmap on a server uses up resources on that target server, so any such test needs to be done carefully, and with consideration for any server that doesn’t belong to you.

Various Types of nmap Scanning

There are various ways in which you can use nmap to scan remote systems. Here’s a list of common methods, as well as what we use them for.

Stealthy Scan of Ports via TCP

For a quick way to test the ports of a remote server, we use the command:

sudo nmap -sS scanme.nmap.org

The “-sS” option informs nmap that the scan is to be conducted in “stealth mode”. This means that you server sends TCP packets to the common ports on the target server, but doesn’t wait for the full three way handshake (commonly called SYN, SYN-ACK, ACK). Instead, it sends a “SYN” message, waits for the “SYN-ACK”, and then tears down the connection.

Here’s what the command looks like:

This is what the scan tells us:

1. The scan tells us that out of 1000 ports scanned, 995 of them were closed
2. The ports that are open are 80 (web server), 22 (SSH), 9929, 31337
3. Port 179 is “filtered”, meaning that access to it is being blocked

Now this kind of output is actually quite scary! It means that an attacker who wants to disrupt this server knows that they need to target the open ports. For example, it’s openly shown that SSH is on port 22 and if this gives them a starting point. That’s why it’s so important to have a hardened server where root logins are blocked and where you use SSH keys for login.

TCP Connect Scan

The TCP connect scan is for when the stealthy scan doesn’t work. We use the first kind of scan, not because we’re malicious, but because it’s faster and easier. But sometimes, the target server doesn’t allow to send raw packets because of firewall restrictions. In addition, the user running the command might not have permissions to execute a stealthy scan.

So in a way, this is the more “honest” method of scanning a remote system’s network. The command is:

nmap -sT scanme.nmap.org

This command uses the “-sT” (T stands for TCP) flag to indicate that nmap must try and complete the full TCP handshake (SYN, SYN-ACK, ACK) for each port. If the remote server completes the connection, the port is open. If it sends an RST packet, the port is considered closed. Here’s what it looks like:

You can see that the output is identical to the first command. For servers that don’t have firewall restrictions, this is indeed the case, which is why we usually use the stealthier and faster option whenever we can.

UDP Scans

In addition to TCP scans, a full security assessment must include the UDP protocols and ports as well. These ports are often overlooked while probing security vulnerabilities, so it’s important to not forget them. The problem with UDP is that it’s a connectionless protocol. This means that there’s no easy way to tell whether or not a particular UDP port is open. The nmap command sends multiple transmissions to the UDP ports, and if not response is received, it’s considered open. Here’s the command for scanning UDP ports:

nmap -sU scanme.nmap.org

The “-sU” parameter (“U” stands for UDP) tells nmap that we’re scanning UDP ports. This command can take a long time to complete, compared to a TCP scan – which is one of the reasons why it’s not used as often.

Ping Scan for Host Discovery

Sometimes, you just want to see if a host is online, instead of scanning all their ports. Generally, we’re taught that we use the following command to test if a remote server is online:

ping scanme.nmap.org

But this can fail if the target host is configured to block ICMP echo requests. By contrast, the following command will work:

nmap -sP scanme.nmap.org

The “-sP” parameter (“P” stands for ping) uses a variety of techniques to test the remote server’s availability, not just via ICMP echo requests. Here’s a screenshot:

This command completes very fast – much faster than a traditional ping command, so it’s preferable to use this when possible.

Default Script Scans

Going beyond mere pinging, nmap allows you to both test a server’s ports as well as run some common scripts against them to probe for vulnerabilities. The command to do this is:

nmap -sS -sC scanme.nmap.org

This combines a port scan with “-sC”, which runs a bunch of safe scripts. It gives an output like this:

As you can see, it gives you a bunch of useful information – in this case, the target server’s SSH key! It also checks for the ability to enumerate users, anonymous FTP access, and more.

Conclusion

As you can see, nmap is tremendously useful when creating the security profile of a remote server. Even if the server belongs to you, its configuration can change over time and you should periodically scan it for potential security vulnerabilities, not to mention the possibility of it being compromised without you knowing. Using the various namp scan types, you can choose the kind of profile you want to create.