New answers tagged

1

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. Apart from that using any kind of proxy means that nmap communicates with the IP stack of the proxy and not of the target. This means: ICMP ping can not be done ...


3

For now, use an external tool like proxychains. The nmap documentation for --proxies states, that the feature is not fully implemented yet: Warning: this feature is still under development and has limitations. It is implemented within the nsock library and thus has no effect on the ping, port scanning and OS discovery phases of a scan. Only NSE ...


2

No, if you wanted to scan a whole subnet your computer is basically sending out packets saying Who has 192.168.1.0? Who has 192.168.1.1? Who has 192.168.1.2? Who has 192.168.1.3? and this might be noticed should sufficient monitoring be in place. A way to circumvent this is to run a passive scan using something like netdiscover. This can listen for ARP ...


1

The definition of stealthy is bounded to who is monitoring the network. In general, you can use ARP ping using some automated tool like nmap. It's more faster and reliable than normal IP ping scan. can you exploit the ARP protocol in order to scan stealthily? Normally, ARP activity on LAN is legit, but if you were intense and aggressive in your scan, ...


6

The difference is in the very nature of the two protocols. TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is commonly known as the "three-way handshake" - before data is actually transferred. As the process must happen quickly for a good connection, it can be reasonably ...


4

From the nmap page A big challenge with UDP scanning is doing it quickly. Open and filtered ports rarely send any response, leaving Nmap to time out and then conduct retransmissions just in case the probe or response were lost. Closed ports are often an even bigger problem. They usually send back an ICMP port unreachable error. But unlike the RST ...


2

They are different protocols. At UDP you have to wait for the answer for a specified timeout, at TCP you instantly see that a port is open after getting the three-way handshake. If it's closed, you are most likely to get a packet with the RST flag set, so also you can instantly move on to the next port. It is possible to achieve some extra speed for UDP ...



Top 50 recent answers are included