Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.
  • Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the balance of the port numbers scanned in a statistically random way?

    In other words, for a random IP (i.e. the IP of someone who is not the target of a directed attack) are there ports or ranges of ports that are more or less likely to be scanned?

  • Are there any honeypots that keep track of statistics on port scans of random IPs?

share|improve this question
add comment

6 Answers

up vote 13 down vote accepted

Definitely. See http://nmap.org/svn/nmap-services for a listing of ports and the expected chances that they'll be open.

Nmap offers two options that relate to that:

--top-ports <number>: Scan <number> most common ports
--port-ratio <ratio>: Scan ports more common than <ratio>

Other methods include ports < 1024, listed in an /etc/services files, etc. "By default, Nmap scans the most common 1000 ports for each protocol." I consider nmap to be the default tool, but of course there are others that are common enough.

I would guess that high-numbers ports (49152–65535... the unregistered list) are the least likely to be scanned. See also http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

In no case I can imagine besides generating statistics would statistically random scanning be helpful as compared to deterministic ratio scanning, and I have never heard of anything that does that.

For some statistics from the honey pot side, there are papers out there. http://cseweb.ucsd.edu/~clbailey/PortScans.pdf is an example of one.

share|improve this answer
    
I hadn't realised the nmap list included chances of the port being open. Very cool! –  Rory Alsop Jul 29 '11 at 15:48
    
Fyodor of nmap has included the statistics of a very huge scan to build up a frequency list of open ports. This was included some years back. –  Dog eat cat world Jul 29 '11 at 16:41
add comment

The way attackers go about portscans is to first target those with known exploits or commonly weak protection.

The list at http://www.iss.net/security_center/advice/Exploits/Ports/default.htm is one typical list.

Sure, you get some scanners who go for the entire port range, but as that is far less effective, this list is going to be a pretty good indication of the most scanned ports.

share|improve this answer
3  
That makes sense, because if I were writing a port scanner I'd want to find the open ports before the port scan was detected and blocked. So I'd target those most valuable - with the highest likelihood of being open or the juiciest services. –  user185 Jul 29 '11 at 15:46
    
I agree with the theory, do you have any supporting evidence? –  this.josh Jul 29 '11 at 19:42
add comment

In Addition to @RoryAlsop 's answer, the NMAP project maintains a list of ports along with the likelihood that it will be found to be open here,

share|improve this answer
    
thanks. I presume that list is what's used for nmap's --top-ports option? –  Brian M. Hunt Jul 29 '11 at 15:24
    
I believe so, yes –  Rоry McCune Jul 29 '11 at 15:43
    
Where do they get the data for the probability of a port being open? –  this.josh Jul 29 '11 at 19:50
    
IIRC they did some large scanning of segments of the Internet to come up with the probabilities –  Rоry McCune Jul 30 '11 at 10:45
add comment

DShield's Port Report may have the information you are looking for. DShield collects firewall logs from volunteers and then provides summarized data from the logs to the community.

share|improve this answer
    
+1 great reference. –  Brian M. Hunt Jul 29 '11 at 22:45
add comment

are the balance of the port numbers scanned in a statistically random way?

No, if a scan continues past the "well known services" stage, then it's simply scanning the ranges of ports specified by the user. The user may specify "random" port ranges - "Let's check 10,000 - 12,000 and 27,000 - 29,000" - but that's not statistically random, it's a couple of arbitrary blocks chosen by the user.

The sort of scan you are wondering about, a statistically random distribution of individual ports throughout the entire space, is mathematically unlikely to be any better than a brute force scan of all ports, and is likely to be worse in hit rate (although faster, ha ha). To the best of my knowledge and experience, no tool implements a "scan randomly" setting.

share|improve this answer
    
I thought nmap scanned randomly, but this random order could be turned off with the -r: Scan ports consecutively - don't randomize option? –  Brian M. Hunt Jul 29 '11 at 16:01
    
I believe that affects the order in which specified ports are scanned, not the random selection of (un)specified ports. In other words, that'll mean that a scan might go 80, 443, 995 or 443, 80, 995 or (...). That's to keep scans from being (that much more) obvious when the victim looks at their logs. –  gowenfawr Jul 29 '11 at 17:00
add comment

Security is often a cat-and-mouse game. Some clever people are likely to put their own important private service up on a port that is rarely scanned. So some clever scanners going after whatever it is that the clever people are hiding, might be expected to preferentially look at ports that are rarely-scanned by others.

share|improve this answer
    
+1 - from the data I have seen, although some scans do cover non-standard ports, they are still far outweighed by scans for the usual culprits. –  Rory Alsop Jul 30 '11 at 8:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.