Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -1 down vote favorite
1

Is port scanning legal ? In which countries ?

my option :

I think port scanning is like a short-walk( or a long-walk) in the neighbourhood, just curious about neighbours are up to.

I think that port scanning must be legal. Sometimes you could find an interesting website or ftp etc. ( what if there was not google,yahoo,duckduck ? to search the web )

and it is up to the administrator to use passwords to protect something that does not want to see anyone else.

share|improve this question
Talk to your lawyer! Also some ISPs forbid it in their overreaching service terms. – ewanm89 Oct 5 '12 at 14:23
@ewanm89 WOW really ? have you in mind any ISP ? – jkarr Oct 5 '12 at 14:25
British Telecom: You must not run "port scanning" software which accesses remote machines or networks, except with the explicit prior permission of the administrator or owner of such remote machines or networks. This includes using applications capable of scanning the ports of other Internet users. Click here for a port scanning FAQ. If you intend to run a port scanning application, you must provide BT with a copy of the written consent received from the target of the scan authorising the activity. This must be supplied to BT prior to the application being run. – ewanm89 Oct 5 '12 at 14:38
Comcast: Unauthorized port scanning is strictly prohibited; – ewanm89 Oct 5 '12 at 14:38
1  
interesting discussion: nmap.org/book/legal-issues.html – Andy Smith Oct 5 '12 at 15:38
show 3 more comments

closed as not a real question by Gilles, Thomas Pornin, Scott Pack, Iszi, Jeff Ferland♦ Oct 9 '12 at 3:10

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

2 Answers

up vote 3 down vote

Port scanning is more akin to taking a walk around the neighbourhood and trying every handle of a door and every window to see if it's open, to see if the neighbours have left anything available for future investigation or exploitation/theft.

The walk you describe would be more of a ping sweep - just see if the host is up (or house exists).

Regarding legality, intent plays a big part, and whether you have permission of the target (white-hat vs black-hat). Consult a lawyer.

share|improve this answer
well at your point of view maybe. but from my point of view is something like this : hello good neighbour what are you up today ? neighbour : well go away I do not talk about . ( or if he wants to share ) neighbour: well I have an apache running my new site . – jkarr Oct 5 '12 at 17:25
from your point of view: I have no curtains to my windows and let the people see what happens in my home is this illegal? – jkarr Oct 5 '12 at 17:35
up vote 2 down vote

In short: It is probably prohibited by law (assuming most countries have a law similar to the Dutch), and probably also by your ISP. However I don't think anyone will win a court against you if you don't do anything besides portscanning and don't overload the service. Very strictly speaking, typing a random domain in your address bar would be portscanning as well.

As mentioned in the comments on your question, it is usually prohibited by the ISP. This can be your ISP at home, but it can also be in the terms of a VPS hosting provider.

Besides this, I can only comment on Dutch laws really. It mentions the following as "computer fraud": Intentionally and unlawfully entering an automated work, or part of an automated work. Entering is defined as either:

  • Breaking security;
  • Using a technical procedure;
  • Using false signals or a false key, or
  • Using a false identity.

Clearly you are not breaking security by sending a packet to test whether a port is open or using a false identity, but a technical procedure is a very broad term. Also false signals can mean a lot, probably including sending packets, especially when you can't prove their purpose besides testing whether a port is open for potential abuse. This would fall in the category of unlawfully entering an automated work, given that you have no permission from the target.

Still though, I don't think anyone would win a court against you for portscanning as long as you don't overload the server. Breaking the security is only done after an open port is found.

Disclaimer: IANAL

Source (Dutch): http://wetten.overheid.nl/BWBR0028570/Tweedeboek/TitelV/Artikel144a/geldigheidsdatum_30-06-2012

share|improve this answer
this is exactly what I am talking about.you just see if the port is open and you see the content. if it is open it is not really my fault. – jkarr Oct 5 '12 at 17:32
   
@jkarr "Not really your fault", true, but neither is it your fault if someone leaves their front door open. Still, you are still trespassing when walking inside, regardless of whether you steal or even touch anything. – Luc Oct 5 '12 at 17:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.