Nmap: ICMP Network Scanning.

-

ICMP scanning in Nmap primarily involves sending ICMP echo requests (ping) to remote hosts to determine their online status and measure their response times. Here's how you can perform ICMP network scanning with Nmap:

1. Ping Sweep (ICMP Echo Request Scan):

To perform a basic ping sweep using Nmap, you can use the following command:

nmap -sn <target>

  • `-sn:` This option tells Nmap to perform a "ping scan," which sends ICMP echo requests to the specified target(s) and reports which hosts are online. Replace <target> with the target IP address or a range of IP addresses you want to scan. Nmap will send ICMP echo requests to these targets and provide a list of hosts that responded.

2. ICMP Timestamp Requests (Timestamp Scan):


Nmap can also send ICMP timestamp requests to a target to retrieve information about the system's uptime. To perform an ICMP timestamp scan, use the following command:

nmap -Pn --send-icmp -oA outputfile <target>

  • -Pn: This option tells Nmap not to perform host discovery (ping) but instead scan the specified target(s) directly.
  • --send-icmp: This option instructs Nmap to send ICMP timestamp requests. Replace <target> with the target IP address or range. This scan will provide information about the uptime of the target system(s).
ICMP scanning is often used as a preliminary step in network reconnaissance to identify live hosts within a range of IP addresses. 

Keep in mind that some hosts or network configurations may block ICMP traffic, which can lead to false negatives. 

Additionally, ICMP scanning provides minimal information compared to other Nmap scan types, but it's a useful starting point for network discovery.
-------------------------------------------------------------------------------------------------------------

Question1: How would you perform a ping sweep on the 172.16.x.x network (Netmask: 255.255.0.0) using Nmap? (CIDR notation)

Answer: nmap -sn 172.16.0.0/16
-------------------------------------------------------------------------------------------------------------
Thanks for reading.

Roger - Ozz961

Comments

Post a Comment

Popular posts from this blog

Common Network Commands: IP R

-
IP R Command Overview The `ip r` command is part of the `iproute2` package in Linux systems. It is used for displaying and manipulating the routing table, which determines how network packets are directed to their destinations. This command is vital for network configuration, management, and troubleshooting. Origin and Development The `iproute2` package was created to replace the older `net-tools` package, which included commands like `ifconfig` and `route`. The `ip` command provides a more unified interface for network management, supporting advanced features and modern networking protocols. It offers better capabilities for managing complex networking scenarios, making it a crucial tool for system and network administrators. Basic Functionality The `ip r` command serves several functions: - Displays current routing table entries. - Shows destination networks, gateways, and associated interfaces. - Allows for the addition, deletion, and modification of routes. Key Command Syntax 1. Di...
Read more

Junior Security Analyst Intro

-
Why SOC Analyst L1 is Considered a Triage Specialist. A Level 1 Security Operations Center (SOC) Analyst is often regarded as a triage specialist because they are the first responders to cybersecurity alerts. Much like how a triage nurse assesses patients' conditions in a hospital, a Level 1 SOC Analyst evaluates and categorizes alerts generated by security tools to determine their severity and prioritize response efforts. Their primary focus is to: Filter Noise: Modern networks generate massive amounts of data, with many false positives. SOC L1 analysts must sift through this data to identify real threats. Categorize Alerts: Assign severity levels to incidents, such as low, medium, or high priority. Initial Response: Perform basic investigations (e.g., checking IP addresses, scanning logs) and decide whether to escalate incidents to Level 2 or 3 analysts. This role is vital because it ensures that high-priority threats are addressed quickly and resources are allocated ...
Read more

Example of A Day in the Life of a Junior (Associate) Security Analyst

-
The day begins early for the Junior Security Analyst, stepping into the office or logging into their remote workstation. The quiet hum of servers and the glow of multiple screens set the stage for another day at the heart of the cybersecurity battlefield. Their first task is to review the handover notes from the previous shift or the daily briefing. This update includes summaries of unresolved incidents, ongoing investigations, and any notable changes in the organization’s threat landscape. Equipped with this crucial information, the analyst prepares to navigate a world where even the smallest anomaly could signify a major threat. Logging into the array of tools—a Security Information and Event Management (SIEM) platform, endpoint detection systems, firewalls, and intrusion detection/prevention systems (IDS/IPS)—the analyst is immediately immersed in the flow of alerts. Every beep, flash, and log entry represents a potential threat. The first challenge is triage. Like a digital detecti...
Read more