{"id":165,"date":"2018-07-12T05:48:56","date_gmt":"2018-07-12T05:48:56","guid":{"rendered":"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/?post_type=chapter&#038;p=165"},"modified":"2019-05-14T09:30:18","modified_gmt":"2019-05-14T09:30:18","slug":"threats-in-network","status":"publish","type":"chapter","link":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/chapter\/threats-in-network\/","title":{"rendered":"Threats in Network"},"content":{"raw":"<div><span style=\"float: right;\"><a href=\"https:\/\/youtu.be\/XTaMmay0V7g\" target=\"_blank\" rel=\"noopener\"><img src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"epgp books\" width=\"75px\" height=\"75px;\" \/><\/a>\r\n<\/span><\/div>\r\n\r\nWhat makes a Network Vulnerable?\r\n\r\n<img class=\"size-full wp-image-166 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-98.png\" alt=\"\" width=\"738\" height=\"735\" \/>\r\n\r\nThere are two categories of attacks:\r\n<ul>\r\n \t<li>(i) Active v\/s passive attack<\/li>\r\n \t<li>(ii) Insider v\/s outsider attack<\/li>\r\n<\/ul>\r\n&nbsp;\r\n\r\nWho attacks Networks?\u00a0 The attacker attacks for different reasons.\r\n\r\n&nbsp;\r\n<table class=\"aligncenter\" border=\"1\">\r\n<tbody>\r\n<tr>\r\n<td style=\"width: 134.063px\">Challenge<\/td>\r\n<td style=\"width: 77.0625px\">Fame<\/td>\r\n<td style=\"width: 149.063px\">Money and<\/td>\r\n<td style=\"width: 140.063px\">Organized<\/td>\r\n<td style=\"width: 118.063px\">Ideology<\/td>\r\n<\/tr>\r\n<tr>\r\n<td style=\"width: 134.063px\"><\/td>\r\n<td style=\"width: 77.0625px\"><\/td>\r\n<td style=\"width: 149.063px\">Espionage<\/td>\r\n<td style=\"width: 140.063px\">crime<\/td>\r\n<td style=\"width: 118.063px\"><\/td>\r\n<\/tr>\r\n<tr>\r\n<td style=\"width: 134.063px\"><\/td>\r\n<td style=\"width: 77.0625px\"><\/td>\r\n<td style=\"width: 149.063px\"><\/td>\r\n<td style=\"width: 140.063px\"><\/td>\r\n<td style=\"width: 118.063px\"><\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n&nbsp;\r\n\r\n&nbsp;\r\n\r\n<strong>Hactivism and cyberterrorism:<\/strong>\r\n\r\n&nbsp;\r\n<p style=\"text-align: justify\">Hactivism involves all kinds of activities with hacking techniques applied to a target\u2019s network. These activities just disrupt routine operations, do not cause serious damage. Cyberterrorism involves all kind of activities (politically motivated) with hacking operations that cause harm including loss of life or economic brekdown.<\/p>\r\n&nbsp;\r\n\r\n&nbsp;\r\n\r\n<strong>How attackers gather information?<\/strong>\r\n\r\n&nbsp;\r\n\r\nport scan\u00a0 pinging\u00a0 Port Scan: Port Scan can reveal three facts.\r\n<ol>\r\n \t<li>Which standard ports are up and services are running and answering on the target system.<\/li>\r\n \t<li>Which operating system is installed on target machine?<\/li>\r\n \t<li>What applications and their versions are installed?<\/li>\r\n<\/ol>\r\nPinging: Ping is used to check whether host is alive. Ping, sends ICMP echo request, causing the target to respond with an ICMP reply packet.\r\n\r\nPort scanning :For rendering services, TCP\/IP protocol suit uses 2 primary protocols\r\n<ul>\r\n \t<li>1) TCP<\/li>\r\n \t<li>2) UDP<\/li>\r\n<\/ul>\r\n<p style=\"text-align: justify\">Every TCP and UDP packet contains information about source port and destination port.Port numbers are given numbers ranging from 0-65535 which requires 16 bits.Port scanning methods \u2013<\/p>\r\n&nbsp;\r\n<ol>\r\n \t<li>TCP Connect(Not stealth-not secret)<\/li>\r\n<\/ol>\r\n<ul>\r\n \t<li>Uses open system call provided by kernel to connect to specified ports on the target host.<\/li>\r\n \t<li>Opens TCP connection via TCP 3 way handshake.<\/li>\r\n \t<li><img class=\"size-full wp-image-167 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-99.png\" alt=\"\" width=\"282\" height=\"227\" \/><\/li>\r\n<\/ul>\r\n<p style=\"text-align: justify\">TCP connect scan finishes the three way handshake, the application listening on the destination\u00a0port will answer to this request for connection.\u00a0Application will log the connection attempt.<\/p>\r\n\r\n<ol start=\"2\">\r\n \t<li style=\"text-align: justify\">TCP SYN\/Half open(stealth): In this method, Scanner sends SYN<span style=\"text-align: initial;font-size: 1em\"> packet to the target host. If target host is listening on <\/span>particular<span style=\"text-align: initial;font-size: 1em\"> port then responds with SYN+ACK.\u00a0<\/span>If target host is alive but not listening on a particular port, RST packet will be sent. In this method, Scanning does not complete the 3 way<span style=\"text-align: initial;font-size: 1em\"> handshake, that is why this method is stealthy because nothing is logged by <\/span>target<span style=\"text-align: initial;font-size: 1em\"> host.<\/span><\/li>\r\n \t<li style=\"text-align: justify\">FIN In this method, FIN packet is sent to target<span style=\"text-align: initial;font-size: 1em\"> host. If target host alive and not listening on a particular port, then target host will respond with RST packet. If target host is listening on a particular port, it will not respond.\u00a0<\/span>Microsoft host sends RST packet in all cases. Host<span style=\"text-align: initial;font-size: 1em\"> is identified as Microsoft windows host.<\/span><\/li>\r\n \t<li style=\"text-align: justify\">XMAS In this method, the host sends out a packet with FIN, URG and PUSH flags set. If target host is listening on a particular port, it sends an RST packet back. If target host not listening on that port,<span style=\"text-align: initial;font-size: 1em\"> does not respond.<\/span><\/li>\r\n \t<li style=\"text-align: justify\">NULl In this method, the host sends a TCP packet to the destination host with all the flags turned off in the TCP header. If the target host is listening on a particular port, does not respond. If target host is not listening on a particular ports<span style=\"text-align: initial;font-size: 1em\">, sends an RST packet.<\/span><\/li>\r\n \t<li style=\"text-align: justify\">RPC In this method, the host sends NULL commands, to open ports to determine if they are RPC ports. If Open port is RPC port, then which application is bound to that port is checked and information<span style=\"text-align: initial;font-size: 1em\"> is obtained.<\/span><\/li>\r\n \t<li style=\"text-align: justify\">ACK\u00a0 In this method, the host sends ACK packets to target<span style=\"text-align: initial;font-size: 1em\"> host. Target host does not respond or sends back ICMP unreachable packet, <\/span>port<span style=\"text-align: initial;font-size: 1em\"> is filtered by <\/span>firewall<span style=\"text-align: initial;font-size: 1em\">. This method is used to check firewall sets. If <\/span>target<span style=\"text-align: initial;font-size: 1em\"> sends back RST packet, <\/span>port<span style=\"text-align: initial;font-size: 1em\"> is not filtered by <\/span>firewall<span style=\"text-align: initial;font-size: 1em\">.<\/span><\/li>\r\n \t<li style=\"text-align: justify\">Window This method detects open, filtered and unfiltered ports on some systems due to reported anomaly<span style=\"text-align: initial;font-size: 1em\"> in the window sizes of TCP.<\/span><\/li>\r\n \t<li style=\"text-align: justify\">UDP This method sends UDP<span style=\"text-align: initial;font-size: 1em\"> packet. If target host is not listening on the port used for communication, an ICMP port unreachable packet is received. If target host is listening on the port used for communication, the sending host does not receive such packet. Scanning with UDP is unreliable as UDP is not connection oriented.\u00a0<\/span>ry nmap<span style=\"text-align: initial;font-size: 1em\"> Download <\/span>nmap<span style=\"text-align: initial;font-size: 1em\"> from https::\/\/nmap.org<\/span>In the command tab type:<\/li>\r\n<\/ol>\r\n1) nmap \u2013sS \u2013p 22.25.80.443 192.168.100.0\/24\r\n\r\n2) nmap - - help\r\n\r\n&nbsp;\r\n\r\n<img class=\"size-full wp-image-168 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-100.png\" alt=\"\" width=\"473\" height=\"195\" \/>\r\n<p style=\"text-align: justify\">3) Perform ping sweeps nmap \u2013sP nmap -sF 216.58.220.4\u00a0 ******FIN scanning\u00a0 Starting Nmap 6.49BETA5 ( https:\/\/nmap.org ) at 2015-11-03 21:15 India Standard Time Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn\u00a0 Nmap done: 1 IP address (0 hosts up) scanned in 4.03 seconds\u00a0 nmap -sT 216.58.220.4\u00a0 ****TCP connect port scan\u00a0 Starting Nmap 6.49BETA5 ( https:\/\/nmap.org ) at 2015-11-03 21:17 India Standard Time Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn\u00a0\u00a0<span style=\"text-align: initial;font-size: 1em\">Nmap <\/span>done<span style=\"text-align: initial;font-size: 1em\">: 1 IP address (0 hosts up) scanned in 4.20 seconds\u00a0<\/span><span style=\"text-align: initial;font-size: 1em\">nmap -sX 216.58.220.4<\/span><\/p>\r\n\r\n<div>\r\n\r\n&nbsp;\r\n\r\n***XMAS scanning\r\n\r\n&nbsp;\r\n\r\nStarting Nmap 6.49BETA5 ( https:\/\/nmap.org ) at 2015-11-03 21:18 India Standard Time Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 4.04 seconds\u00a0 Perform TCP pings\u00a0 nmap \u2013PT[port_number] host\r\n\r\n&nbsp;\r\n\r\nnmap \u2013PT6000 192.168.1.1\u00a0 if a host responds with a RST packet, nmap considers the host is alive, perform port scan immediately by default nmap sends ACK packet to port 80\r\n\r\n&nbsp;\r\n\r\nPerform TCP-connect port scans\u00a0 nmap \u2013sT 10.0.0.1\r\n\r\nPerform SYN scanning nmap \u2013sS 192.168.1.150\r\n\r\nPerform FIN scan\u00a0 nmap \u2013sF 192.168.1.100\r\n\r\nXMAS scanning\u00a0 nmap \u2013sX 192.168.1.1\r\n\r\nNULL scanning nmap \u2013sN 192.168.1.100\r\n\r\nRPC scanning\u00a0 nmap \u2013sR 10.0.0.10\r\n\r\nIP protocol scanning\r\n\r\nnmap \u2013sO 192.168.1.1\r\n\r\nUDP Port scanning nmap \u2013sU 192.168.1.100\r\n\r\n<\/div>\r\n&nbsp;\r\n\r\n<strong>Countermeasure:<\/strong>\r\n<ol>\r\n \t<li>Block ICMP Configure firewall<span style=\"text-align: initial;font-size: 1em\"> to drop incoming echo requests and outgoing ICMP echo replies.<\/span><\/li>\r\n \t<li style=\"text-align: justify\">Prevent TCP ping scans\u00a0 Use stateful<span style=\"text-align: initial;font-size: 1em\"> firewall to protect <\/span>network<span style=\"text-align: initial;font-size: 1em\">. Configure <\/span>firewall<span style=\"text-align: initial;font-size: 1em\"> to drop all ACK packets if those packets do not belong to the TCP connection established already.<\/span><\/li>\r\n \t<li style=\"text-align: justify\">Defend against port scan\u00a0 Configure firewall<span style=\"text-align: initial;font-size: 1em\"> to drop packets destined for closed ports. Most firewalls and IDSs have the ability to detect port scans. Use <\/span>stateful<span style=\"text-align: initial;font-size: 1em\"> firewall.<\/span><\/li>\r\n<\/ol>\r\n&nbsp;\r\n\r\n<b>\u00a0<img class=\"size-full wp-image-169 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-101.png\" alt=\"\" width=\"981\" height=\"619\" \/><\/b>\r\n\r\n&nbsp;\r\n<table>\r\n<tbody>\r\n<tr>\r\n<td><strong>you can view video on Threats in Network<\/strong><\/td>\r\n<td><a href=\"https:\/\/youtu.be\/XTaMmay0V7g\" target=\"_blank\" rel=\"noopener\"><img class=\"alignnone wp-image-120\" src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"\" width=\"36\" height=\"36\" \/><\/a><\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n&nbsp;\r\n\r\n<strong>Suggested Reading:<\/strong>\r\n<ol>\r\n \t<li>Cryptography and Network Security Principles and Practice by William Stallings, sixth Edition, PEARSON.<\/li>\r\n \t<li>Security in Computing by Charles Pfleeger &amp; Shari Lawrence Pfleeger, fourth Edition, PEARSON.<\/li>\r\n \t<li>Network Security by Charlie Kaufman, Radia Perlman, Mike Speciner, second Edition, PHI.<\/li>\r\n \t<li>The Complete Reference \u2013 Network Security by Roberta Bragg, Mark Rhodes-Ousley &amp; Keith Strassberg, Tata McGraw Hill<\/li>\r\n \t<li>Network Security Bible by Eric Cole, Ronald Krutz, James Conley, Wiley<\/li>\r\n \t<li>Hacking 6 Exposed by Stuart McClure, Joel Scambray &amp; George Kurtz , Tata McGraw Hill .<\/li>\r\n \t<li><a href=\"http:\/\/www.snort.org\/\">www.snort.org<\/a><\/li>\r\n \t<li><a href=\"https:\/\/nmap.org\/\">https:\/\/nmap.org<\/a><\/li>\r\n<\/ol>\r\n&nbsp;\r\n\r\n&nbsp;","rendered":"<div><span style=\"float: right;\"><a href=\"https:\/\/youtu.be\/XTaMmay0V7g\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"epgp books\" width=\"75px\" height=\"75px;\" \/><\/a><br \/>\n<\/span><\/div>\n<p>What makes a Network Vulnerable?<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-166 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-98.png\" alt=\"\" width=\"738\" height=\"735\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-98.png 738w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-98-150x150.png 150w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-98-300x300.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-98-65x65.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-98-225x224.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-98-350x349.png 350w\" sizes=\"auto, (max-width: 738px) 100vw, 738px\" \/><\/p>\n<p>There are two categories of attacks:<\/p>\n<ul>\n<li>(i) Active v\/s passive attack<\/li>\n<li>(ii) Insider v\/s outsider attack<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Who attacks Networks?\u00a0 The attacker attacks for different reasons.<\/p>\n<p>&nbsp;<\/p>\n<table class=\"aligncenter\">\n<tbody>\n<tr>\n<td style=\"width: 134.063px\">Challenge<\/td>\n<td style=\"width: 77.0625px\">Fame<\/td>\n<td style=\"width: 149.063px\">Money and<\/td>\n<td style=\"width: 140.063px\">Organized<\/td>\n<td style=\"width: 118.063px\">Ideology<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 134.063px\"><\/td>\n<td style=\"width: 77.0625px\"><\/td>\n<td style=\"width: 149.063px\">Espionage<\/td>\n<td style=\"width: 140.063px\">crime<\/td>\n<td style=\"width: 118.063px\"><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 134.063px\"><\/td>\n<td style=\"width: 77.0625px\"><\/td>\n<td style=\"width: 149.063px\"><\/td>\n<td style=\"width: 140.063px\"><\/td>\n<td style=\"width: 118.063px\"><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Hactivism and cyberterrorism:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: justify\">Hactivism involves all kinds of activities with hacking techniques applied to a target\u2019s network. These activities just disrupt routine operations, do not cause serious damage. Cyberterrorism involves all kind of activities (politically motivated) with hacking operations that cause harm including loss of life or economic brekdown.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>How attackers gather information?<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>port scan\u00a0 pinging\u00a0 Port Scan: Port Scan can reveal three facts.<\/p>\n<ol>\n<li>Which standard ports are up and services are running and answering on the target system.<\/li>\n<li>Which operating system is installed on target machine?<\/li>\n<li>What applications and their versions are installed?<\/li>\n<\/ol>\n<p>Pinging: Ping is used to check whether host is alive. Ping, sends ICMP echo request, causing the target to respond with an ICMP reply packet.<\/p>\n<p>Port scanning :For rendering services, TCP\/IP protocol suit uses 2 primary protocols<\/p>\n<ul>\n<li>1) TCP<\/li>\n<li>2) UDP<\/li>\n<\/ul>\n<p style=\"text-align: justify\">Every TCP and UDP packet contains information about source port and destination port.Port numbers are given numbers ranging from 0-65535 which requires 16 bits.Port scanning methods \u2013<\/p>\n<p>&nbsp;<\/p>\n<ol>\n<li>TCP Connect(Not stealth-not secret)<\/li>\n<\/ol>\n<ul>\n<li>Uses open system call provided by kernel to connect to specified ports on the target host.<\/li>\n<li>Opens TCP connection via TCP 3 way handshake.<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-167 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-99.png\" alt=\"\" width=\"282\" height=\"227\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-99.png 282w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-99-65x52.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-99-225x181.png 225w\" sizes=\"auto, (max-width: 282px) 100vw, 282px\" \/><\/li>\n<\/ul>\n<p style=\"text-align: justify\">TCP connect scan finishes the three way handshake, the application listening on the destination\u00a0port will answer to this request for connection.\u00a0Application will log the connection attempt.<\/p>\n<ol start=\"2\">\n<li style=\"text-align: justify\">TCP SYN\/Half open(stealth): In this method, Scanner sends SYN<span style=\"text-align: initial;font-size: 1em\"> packet to the target host. If target host is listening on <\/span>particular<span style=\"text-align: initial;font-size: 1em\"> port then responds with SYN+ACK.\u00a0<\/span>If target host is alive but not listening on a particular port, RST packet will be sent. In this method, Scanning does not complete the 3 way<span style=\"text-align: initial;font-size: 1em\"> handshake, that is why this method is stealthy because nothing is logged by <\/span>target<span style=\"text-align: initial;font-size: 1em\"> host.<\/span><\/li>\n<li style=\"text-align: justify\">FIN In this method, FIN packet is sent to target<span style=\"text-align: initial;font-size: 1em\"> host. If target host alive and not listening on a particular port, then target host will respond with RST packet. If target host is listening on a particular port, it will not respond.\u00a0<\/span>Microsoft host sends RST packet in all cases. Host<span style=\"text-align: initial;font-size: 1em\"> is identified as Microsoft windows host.<\/span><\/li>\n<li style=\"text-align: justify\">XMAS In this method, the host sends out a packet with FIN, URG and PUSH flags set. If target host is listening on a particular port, it sends an RST packet back. If target host not listening on that port,<span style=\"text-align: initial;font-size: 1em\"> does not respond.<\/span><\/li>\n<li style=\"text-align: justify\">NULl In this method, the host sends a TCP packet to the destination host with all the flags turned off in the TCP header. If the target host is listening on a particular port, does not respond. If target host is not listening on a particular ports<span style=\"text-align: initial;font-size: 1em\">, sends an RST packet.<\/span><\/li>\n<li style=\"text-align: justify\">RPC In this method, the host sends NULL commands, to open ports to determine if they are RPC ports. If Open port is RPC port, then which application is bound to that port is checked and information<span style=\"text-align: initial;font-size: 1em\"> is obtained.<\/span><\/li>\n<li style=\"text-align: justify\">ACK\u00a0 In this method, the host sends ACK packets to target<span style=\"text-align: initial;font-size: 1em\"> host. Target host does not respond or sends back ICMP unreachable packet, <\/span>port<span style=\"text-align: initial;font-size: 1em\"> is filtered by <\/span>firewall<span style=\"text-align: initial;font-size: 1em\">. This method is used to check firewall sets. If <\/span>target<span style=\"text-align: initial;font-size: 1em\"> sends back RST packet, <\/span>port<span style=\"text-align: initial;font-size: 1em\"> is not filtered by <\/span>firewall<span style=\"text-align: initial;font-size: 1em\">.<\/span><\/li>\n<li style=\"text-align: justify\">Window This method detects open, filtered and unfiltered ports on some systems due to reported anomaly<span style=\"text-align: initial;font-size: 1em\"> in the window sizes of TCP.<\/span><\/li>\n<li style=\"text-align: justify\">UDP This method sends UDP<span style=\"text-align: initial;font-size: 1em\"> packet. If target host is not listening on the port used for communication, an ICMP port unreachable packet is received. If target host is listening on the port used for communication, the sending host does not receive such packet. Scanning with UDP is unreliable as UDP is not connection oriented.\u00a0<\/span>ry nmap<span style=\"text-align: initial;font-size: 1em\"> Download <\/span>nmap<span style=\"text-align: initial;font-size: 1em\"> from https::\/\/nmap.org<\/span>In the command tab type:<\/li>\n<\/ol>\n<p>1) nmap \u2013sS \u2013p 22.25.80.443 192.168.100.0\/24<\/p>\n<p>2) nmap &#8211; &#8211; help<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-168 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-100.png\" alt=\"\" width=\"473\" height=\"195\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-100.png 473w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-100-300x124.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-100-65x27.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-100-225x93.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-100-350x144.png 350w\" sizes=\"auto, (max-width: 473px) 100vw, 473px\" \/><\/p>\n<p style=\"text-align: justify\">3) Perform ping sweeps nmap \u2013sP nmap -sF 216.58.220.4\u00a0 ******FIN scanning\u00a0 Starting Nmap 6.49BETA5 ( https:\/\/nmap.org ) at 2015-11-03 21:15 India Standard Time Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn\u00a0 Nmap done: 1 IP address (0 hosts up) scanned in 4.03 seconds\u00a0 nmap -sT 216.58.220.4\u00a0 ****TCP connect port scan\u00a0 Starting Nmap 6.49BETA5 ( https:\/\/nmap.org ) at 2015-11-03 21:17 India Standard Time Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn\u00a0\u00a0<span style=\"text-align: initial;font-size: 1em\">Nmap <\/span>done<span style=\"text-align: initial;font-size: 1em\">: 1 IP address (0 hosts up) scanned in 4.20 seconds\u00a0<\/span><span style=\"text-align: initial;font-size: 1em\">nmap -sX 216.58.220.4<\/span><\/p>\n<div>\n<p>&nbsp;<\/p>\n<p>***XMAS scanning<\/p>\n<p>&nbsp;<\/p>\n<p>Starting Nmap 6.49BETA5 ( https:\/\/nmap.org ) at 2015-11-03 21:18 India Standard Time Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 4.04 seconds\u00a0 Perform TCP pings\u00a0 nmap \u2013PT[port_number] host<\/p>\n<p>&nbsp;<\/p>\n<p>nmap \u2013PT6000 192.168.1.1\u00a0 if a host responds with a RST packet, nmap considers the host is alive, perform port scan immediately by default nmap sends ACK packet to port 80<\/p>\n<p>&nbsp;<\/p>\n<p>Perform TCP-connect port scans\u00a0 nmap \u2013sT 10.0.0.1<\/p>\n<p>Perform SYN scanning nmap \u2013sS 192.168.1.150<\/p>\n<p>Perform FIN scan\u00a0 nmap \u2013sF 192.168.1.100<\/p>\n<p>XMAS scanning\u00a0 nmap \u2013sX 192.168.1.1<\/p>\n<p>NULL scanning nmap \u2013sN 192.168.1.100<\/p>\n<p>RPC scanning\u00a0 nmap \u2013sR 10.0.0.10<\/p>\n<p>IP protocol scanning<\/p>\n<p>nmap \u2013sO 192.168.1.1<\/p>\n<p>UDP Port scanning nmap \u2013sU 192.168.1.100<\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<p><strong>Countermeasure:<\/strong><\/p>\n<ol>\n<li>Block ICMP Configure firewall<span style=\"text-align: initial;font-size: 1em\"> to drop incoming echo requests and outgoing ICMP echo replies.<\/span><\/li>\n<li style=\"text-align: justify\">Prevent TCP ping scans\u00a0 Use stateful<span style=\"text-align: initial;font-size: 1em\"> firewall to protect <\/span>network<span style=\"text-align: initial;font-size: 1em\">. Configure <\/span>firewall<span style=\"text-align: initial;font-size: 1em\"> to drop all ACK packets if those packets do not belong to the TCP connection established already.<\/span><\/li>\n<li style=\"text-align: justify\">Defend against port scan\u00a0 Configure firewall<span style=\"text-align: initial;font-size: 1em\"> to drop packets destined for closed ports. Most firewalls and IDSs have the ability to detect port scans. Use <\/span>stateful<span style=\"text-align: initial;font-size: 1em\"> firewall.<\/span><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><b>\u00a0<img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-169 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-101.png\" alt=\"\" width=\"981\" height=\"619\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-101.png 981w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-101-300x189.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-101-768x485.png 768w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-101-65x41.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-101-225x142.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-101-350x221.png 350w\" sizes=\"auto, (max-width: 981px) 100vw, 981px\" \/><\/b><\/p>\n<p>&nbsp;<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>you can view video on Threats in Network<\/strong><\/td>\n<td><a href=\"https:\/\/youtu.be\/XTaMmay0V7g\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-120\" src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"\" width=\"36\" height=\"36\" \/><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<p><strong>Suggested Reading:<\/strong><\/p>\n<ol>\n<li>Cryptography and Network Security Principles and Practice by William Stallings, sixth Edition, PEARSON.<\/li>\n<li>Security in Computing by Charles Pfleeger &amp; Shari Lawrence Pfleeger, fourth Edition, PEARSON.<\/li>\n<li>Network Security by Charlie Kaufman, Radia Perlman, Mike Speciner, second Edition, PHI.<\/li>\n<li>The Complete Reference \u2013 Network Security by Roberta Bragg, Mark Rhodes-Ousley &amp; Keith Strassberg, Tata McGraw Hill<\/li>\n<li>Network Security Bible by Eric Cole, Ronald Krutz, James Conley, Wiley<\/li>\n<li>Hacking 6 Exposed by Stuart McClure, Joel Scambray &amp; George Kurtz , Tata McGraw Hill .<\/li>\n<li><a href=\"http:\/\/www.snort.org\/\">www.snort.org<\/a><\/li>\n<li><a href=\"https:\/\/nmap.org\/\">https:\/\/nmap.org<\/a><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"author":4,"menu_order":18,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":["miss-hiteishi-diwanji"],"pb_section_license":""},"chapter-type":[],"contributor":[58],"license":[],"class_list":["post-165","chapter","type-chapter","status-publish","hentry","contributor-miss-hiteishi-diwanji"],"part":3,"_links":{"self":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/165","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/users\/4"}],"version-history":[{"count":7,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/165\/revisions"}],"predecessor-version":[{"id":456,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/165\/revisions\/456"}],"part":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/parts\/3"}],"metadata":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/165\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/media?parent=165"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapter-type?post=165"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/contributor?post=165"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/license?post=165"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}