Estimate the number of host computers on the private network by port scanning

Question

If we have a private network connected to the Internet with NAT, how can an attacker estimate the number of host computers in network using port scanning? For both possible modes, the attacker inside and outside the private network.

Answer 1

From outside the a NAT network no direct port scanning of the internal network is possible. This is because packets from outside will only be forwarded to the internal network if there is some connection established from inside which matches the packet. See also Scan a computer behind NAT.

Scanning from inside is mostly trivial though: just enumerate all possible hosts in the local network and try the reaction to common ports. If there is some kind of response (i.e. SYN+ACK, RST, ...) then there is likely computer with this IP address.

And while direct scanning from outside is not possible, an outside attacker might actually be able to scan from inside. All what is needed for this is to lure somebody inside the internal network to a site controlled the attacker and then use the browser as the vehicle to scan the internal network. This is possible because the browser on an internal system has at the same time access to the internet and also internal network. See for example Exposing Intranets with reliable Browser-based Port scanning for more details.

Apart from active discovery there are also ways to passively detect the number of (active) devices behind a NAT. See for example Detecting NAT Devices using sFlow and other research.