Are some uncommon TCP ports scanned less than others?

Question

• Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the balance of the port numbers scanned in a statistically random way?

  In other words, for a random IP (i.e. the IP of someone who is not the target of a directed attack) are there ports or ranges of ports that are more or less likely to be scanned?

• Are there any honeypots that keep track of statistics on port scans of random IPs?

Answer 1

Definitely. See http://nmap.org/svn/nmap-services for a listing of ports and the expected chances that they'll be open.

Nmap offers two options that relate to that:

--top-ports <number>: Scan <number> most common ports
--port-ratio <ratio>: Scan ports more common than <ratio>

Other methods include ports < 1024, listed in an /etc/services files, etc. "By default, Nmap scans the most common 1000 ports for each protocol." I consider nmap to be the default tool, but of course there are others that are common enough.

I would guess that high-numbers ports (49152–65535... the unregistered list) are the least likely to be scanned. See also http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

In no case I can imagine besides generating statistics would statistically random scanning be helpful as compared to deterministic ratio scanning, and I have never heard of anything that does that.

For some statistics from the honey pot side, there are papers out there. http://cseweb.ucsd.edu/~clbailey/PortScans.pdf is an example of one.

Answer 2

The way attackers go about portscans is to first target those with known exploits or commonly weak protection.

The list at http://www.iss.net/security_center/advice/Exploits/Ports/default.htm is one typical list.

Sure, you get some scanners who go for the entire port range, but as that is far less effective, this list is going to be a pretty good indication of the most scanned ports.

Answer 3

In Addition to @RoryAlsop 's answer, the NMAP project maintains a list of ports along with the likelihood that it will be found to be open here,

Answer 4

DShield's Port Report may have the information you are looking for. DShield collects firewall logs from volunteers and then provides summarized data from the logs to the community.

Answer 5

are the balance of the port numbers scanned in a statistically random way?

No, if a scan continues past the "well known services" stage, then it's simply scanning the ranges of ports specified by the user. The user may specify "random" port ranges - "Let's check 10,000 - 12,000 and 27,000 - 29,000" - but that's not statistically random, it's a couple of arbitrary blocks chosen by the user.

The sort of scan you are wondering about, a statistically random distribution of individual ports throughout the entire space, is mathematically unlikely to be any better than a brute force scan of all ports, and is likely to be worse in hit rate (although faster, ha ha). To the best of my knowledge and experience, no tool implements a "scan randomly" setting.

Answer 6

Security is often a cat-and-mouse game. Some clever people are likely to put their own important private service up on a port that is rarely scanned. So some clever scanners going after whatever it is that the clever people are hiding, might be expected to preferentially look at ports that are rarely-scanned by others.