I would like to scan open ports of a server. But as far as I know, when I try to scan the open ports with something like nmap in shell they would be able to trace me. Is there a way to secure this scanning to make sure they would not be able to trace back?

  • 7
    How do I measure the position of electron without affecting its momentum? Sep 27, 2012 at 10:58
  • @HubertKario I don't understand your sarcasm
    – Erfan
    Sep 27, 2012 at 13:18
  • @Erfan, it's a Heisenberg Uncertainty Principle joke, and as such the number of people on earth who truly understand it is probably counted on one hand.
    – gowenfawr
    Sep 27, 2012 at 13:34
  • @gowenfawr sorry for being pedantic, but it's the Observer Effect, not the Uncertainty Principle (for your credit, Heisenberg himself did confuse the two). Erfan: what I meant, is that the act of measuring leaves a trace behind. Its a property of the underling universe we all live in. As such, because the computers exist in the same universe (and you're not performing the test from outside the universe/simulation) you can't do it without leaving a trace, you can only minimise the effect. Sep 27, 2012 at 14:37
  • 2
    "All data leaves a trail. The search for data leaves a trail. The erasure of data leaves a trail. The absence of data, under the right circumstances, can leave the clearest trail of all." Dr. Kio Masada as quoted in This Alien Shore by C.S. Friedman
    – gowenfawr
    Sep 27, 2012 at 14:42

4 Answers 4


Along with the options already provided, the use of anonymous gateways can provide substantial cover for scans. Tor, for example, should provide enough entry and exit points that any trace is unlikely to be successful.


Depending on the environment of your scan and where the server is located etc. You may be able to accomplish this using a TCP Idle Scan - http://nmap.org/book/idlescan.html

You could also do your scanning via a proxy http://funoverip.net/2010/11/socks-proxy-servers-scanning-with-nmap/

Both the above methods are more covert but neither is completely untraceable so do consider this.

Also you should consider legality of port scanning a system unless you have permission to do so - http://nmap.org/book/legal-issues.html

  • and FTP bounce scan...
    – rook
    Sep 27, 2012 at 15:09
  • 1
    @Rook But in that case you may leave logs on the FTP box.
    – Polynomial
    Sep 28, 2012 at 6:02

To 'scan' ports, you need to send traffic to the port to get a response. But, beside Idle Scans and proxies to get other targets to send the traffic for you, there are 2 other covert options to enumerate a target's ports:

  • passive sniffing
  • get the target to tell you

Sniffing the network allows you view traffic to/from various ports. As sniffing is passive, you could not be traced. This depends on active traffic from ports during the sniffing window.

The other option is most likely outside expectation, but I include for completenes-sake: once you obtain access to a target, you can query the target to tell you what ports are available. You might get a shell on a vulnerable web server through port 80, then run netstat to see what other ports are listening and on what interfaces. Traffic to the target shell is over normal channels (web traffic) and although traceable, can easily get lost in the noise. This avenue of enumeration is not to be overlooked.

Both of these options require you to be close to the target or have an exploit vector, but they have been helpful to me in the past.


There are two ways to make the scan nearly untraceable (only if the system under attack hasn't been configured specifically for detecting scans).

  1. perform it over long time (1 port probe every 24h, or longer, preferably intermixed with legitimate traffic)
  2. perform it using multiple computers (preferably 1 port per computer/IP)

The first one will take a long time (during which the firewall configuration can change) or will require massive amount of computers (and can hit per IP blocks instead of port blocks).

Continuing the quantum physics references: this is similar to the Uncertainty Principle ;)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .