I had been reading a blog post on trapx.com about how they go about threat analysis and following statement was made; "advanced attackers no longer perform noisy network scans. If they do network scans at all, they avoid detection by using single-packet connect requests on well-known ports, at an extremely slow rate".

How does one perform a single-packet connect request at an extremely slow rate? Is it possible to do this using nmap, if so how can it be done?

  • 2
    Have you read the nmap manual? They have a whole section on this.
    – schroeder
    Mar 13 '17 at 9:49

It simply means to do something like try a single connection attempt to a single port with a lot of time between.

But what "slow" means and how much time is not defined. 1/hr? 1/day? It depends on how stealthy the person wants to be and what their goals are.

nmap has many config options to do this (read the manual: https://nmap.org/book/man-performance.html)

For instance: T0 sends a single connection attempt to one port at a time with 5 minutes in between. There are numerous finer config options where you can define exactly what you want to do.

I challenge the statement that noisy network scans are not performed by advanced hackers. It really depends on the situation. There is no reason to go slow on a public IP. Internal IPs, once you are inside and re-enumerating, would need this, but this is not something that only advanced attackers would do. It's just a response to the reality that noisy scans would be discovered and so would the attacker. Typically, the attacker would listen to traffic or do other enumerations to get a sense of what servers are available and what they serve.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.