0

I want to find out how -PS works for service discovery very well when there are the stealth scan options such as -sS, available in nmap.

I am currently testing nmap.scanme.org and I know there is a full TCP handshake on some ports so a stealth scan is advised but -PS seems to give me just what I am looking for, service name on the port.

"The -P* options (which select ping types) can be combined. You can increase your odds of penetrating strict firewalls by sending many probe types using different TCP ports/flags and ICMP codes."

This is what caught my attention from the man page of nmap. I still don't see how it is possible for -PS to perform this fast and indeed successful when you also take into consideration the -sS option. ICMP codes may be the culprit but I am not sure to be honest.

Improve this question
2
  • 2
    Have you read the man pages? What bit didn't you understand?
    – Rory Alsop ♦
    Jun 20 at 12:41
  • @RoryAlsop A three way handshake and closing of the connection follows when you look for a port's availability. Here, -PS usage does seem to be successful when -sS is logically needed in order to avoid the issue in my first sentence here. I have read the --help only, sorry. I will be checking further.
    – predatororc
    Jun 20 at 13:23

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.