Tag Info

New answers tagged


This is a known issue with TCP Connect (-sT) scans in Nmap 6.40 through 6.47. It's really a "problem" with Linux itself, as I mentioned in an answer to the same question at StackOverflow, which allows a process to connect to itself by using the same source and destination port. Nmap used to have a workaround to detect the situation, but it got removed in a ...


A stealth scan would not necessarily attract more attention than a connect scan, the whole point of a stealth scan is to attract less. What this book may be implying is that a stealth scan is more of a concern than a connect scan. Connect scans can be used to simply gain information about what is online, they don't try to hide what they are doing. An ...


Nmap, like any adversary tool, can be fingerprinted by Intrusion Detection Systems (IDS). As such, any of Nmap's techniques are generally classified as an attack by these modern tools -- especially Next-generation Firewall (NGFW) technologies, or the bleeding-edge equivalents of NGFWs. Additionally, information sharing alliance centers (ISACs) are sharing ...


Manual DDoS mitigation( taking control over the ports ) is no longer recommended due to DDoS attackers being able to circumvent DDoS mitigation software that is activated manually. Best practices for DDoS mitigation include having both anti-DDoS technology and anti-DDoS emergency response services


The only thing I can think of is a broadcast storm or similar, where responses from the target are what's keeping the attack going. These are rare and almost invariably accidental, and there's an easier way to stop them than messing around with ports: just take the target system briefly offline.


Are you explicitly specifying a UDP scan in nmap (-sU)? I would be surprised if you can get the time down to 3 seconds. Also be aware that using -T5 can cause issues, such as DoS or inaccurate results. Also be aware that there is no requirement for UDP ports to reply to your packets, which is why UDP scanning is more difficult than TCP. Ref: ...

Top 50 recent answers are included