Port scanning & fingerprinting¶

1. Context & stakes¶

Scanning techniques and TCP/IP stack fingerprinting.

Scanning enumerates which ports respond and, from subtle TCP/IP stack differences, fingerprints the OS and services behind them - the reconnaissance that precedes targeted exploitation. Response patterns of SYN/ACK, RST or silence, plus timing, reveal the network's shape. Rate-based detection and default-deny firewalls raise the cost and lower the yield of the scan.

2. Theory¶

A scan probes ports to find which are open. A SYN scan sends SYN and reads SYN/ACK (open) vs RST (closed) without finishing the handshake; FIN/NULL/Xmas scans use the RFC-793 rule that closed ports RST an out-of-state segment while open ports stay silent. Response timing and TCP options also fingerprint the OS.

3. Attack (PoC)¶

netlab-portscan attack --i-own-this-network --iface veth-host

1. SYN/FIN/NULL/Xmas scans
2. OS fingerprint (TCP options, TTL)

4. Detection¶

netlab-portscan detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense¶

• Scan detection, rate-limit
• Drop stealth scans

6. Exercise¶

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading¶

• Nmap Network Scanning; RFC 793 (TCP)
• p0f - passive OS fingerprinting