Nmap: how to traceroute (part-18)

Traceroute
The --traceroute parameter can be use to trace the network path to the specified
host.
Usage syntax: nmap --traceroute [target]

# nmap --traceroute scanme.insecure.org
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:01 CDT
Interesting ports on scanme.nmap.org (64.13.134.52):
Not shown: 996 filtered ports
PORT STATE SERVICE
53/tcp open domain
70/tcp closed gopher
80/tcp open
http
113/tcp closed auth
TRACEROUTE (using port 113/tcp)
HOP RTT
ADDRESS
1 0.91
home (192.168.1.254)
2 24.40 99-60-32-2.lightspeed.wchtks.sbcglobal.net (99.60.32.2)
3 23.12 76.196.172.4
4 22.69 151.164.94.52
5 32.79 ex3-p12-0.eqdltx.sbcglobal.net (69.220.8.53)
6 32.74 asn2828-XO.eqdltx.sbcglobal.net (151.164.249.134)
...
13 74.90 ip65-46-255-94.z255-46-65.customer.algx.net (65.46.255.94)
14 75.01 scanme.nmap.org (64.13.134.52)
Nmap done: 1 IP address (1 host up) scanned in 33.72 seconds

Output of a traceroute scan
The information displayed is similar to the traceroute or tracepath commands
found on Unix and Linux systems - with the added bonus of Nmap�s tracing being
functionally superior to these commands.

Nmap: how to PING (part-18)

ICMP Timestamp Ping

The -PP option performs an ICMP timestamp ping.

Usage syntax: nmap -PP [target]

# nmap -PP 192.168.1.254
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:27 CDT
Interesting ports on home (192.168.1.254):
Not shown: 998 closed ports
PORT STATE SERVICE
80/tcp open
443/tcp open
http
https
MAC Address: 00:25:3C:5F:5A:89 (2Wire)
Nmap done: 1 IP address (1 host up) scanned in 1.83 seconds

Performing an ICMP timestamp ping


While most firewalled systems are configured to block ICMP echo requests, some
improperly configured systems may still reply to ICMP timestamp requests. This
makes -PP useful for attempting to solicit responses from firewalled targets.




ICMP Address Mask Ping
The -PM option performs an ICMP address mask ping.
Usage syntax: nmap -PM [target]

# nmap -PM 192.168.1.254
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:26 CDT
Interesting ports on home (192.168.1.254):
Not shown: 998 closed ports
PORT STATE SERVICE
80/tcp open
443/tcp open
http
https
MAC Address: 00:25:3C:5F:5A:89 (2Wire)
Nmap done: 1 IP address (1 host up) scanned in 1.92 seconds

Performing an ICMP address mask ping
This unconventional ICMP query (similar to the -PP option) attempts to ping the
specified host using alternative ICMP registers. This type of ping can occasionally
sneak past a firewall that is configured to block standard echo requests.




IP Protocol Ping
The -PO option performs an IP protocol ping.
Usage syntax: nmap -PO[protocol1,protocol2,etc] [target]

# nmap -PO 10.10.1.48
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-17 09:38 CDT
Interesting ports on 10.10.1.48:
Not shown: 994 closed ports
PORT STATE SERVICE
21/tcp open
ftp
22/tcp open
ssh
25/tcp open
smtp
80/tcp open
http
111/tcp open
rpcbind
2049/tcp open
nfs
MAC Address: 00:0C:29:D5:38:F4 (VMware)

Performing an IP protocol ping




An IP protocol ping sends packets with the specified protocol to the target. If no
protocols are specified the default protocols 1 (ICMP), 2 (IGMP), and 4 (IP-in-IP) are
used. To ping using a custom set of protocols, use the following syntax:
nmap -PO1,2,4,etc.

NOTE
A complete list of Internet Protocol numbers can be found online at www.iana.org/assignments/protocol-numbers/


ARP Ping
The -PR option instructs Nmap to perform an ARP (Address Resolution Protocol) ping on the specified target.
Usage syntax: nmap -PR [target]

# nmap -PR 192.168.1.254
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:16 CDT
Interesting ports on 192.168.1.254:
Not shown: 998 closed ports
PORT STATE SERVICE
80/tcp open
443/tcp open
http
https
MAC Address: 00:25:3C:5F:5A:89 (2Wire)
Nmap done: 1 IP address (1 host up) scanned in 0.81 seconds

Performing an ARP ping


The -PR option is automatically implied when scanning the local network. This type
of discovery is much faster than the other ping methods described in this guide. It
also has the added benefit of being more accurate because LAN hosts can�t block
ARP requests (even if they are behind a firewall).

NOTE
APR scans cannot be performed on targets that are not on your local subnet.

Nmap: ICMP Echo Ping (part-17)

ICMP Echo Ping


The -PE option performs an ICMP (Internet Control Message Protocol) echo ping on
the specified system.


Usage syntax: nmap -PE [target]

# nmap -PE 192.168.1.254
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:26 CDT
Interesting ports on home (192.168.1.254):
Not shown: 998 closed ports
PORT STATE SERVICE
80/tcp open
443/tcp open
http
https
MAC Address: 00:25:3C:5F:5A:89 (2Wire)
Nmap done: 1 IP address (1 host up) scanned in 1.89 seconds

Performing an ICMP echo ping


The -PE option sends a standard ICMP ping to the target to see if it replies. This type of discovery works best on local networks where ICMP packets can be transmitted with few restrictions. Many internet hosts, however, are configured not respond to
ICMP packets for security reasons.




Note
The -PE option is automatically implied if no other ping options are specified.

Nmap: SCTP INIT Ping (part - 16)

SCTP INIT Ping



The -PY parameter instructs Nmap to perform an SCTP INIT ping.
Usage syntax: nmap -PY[port1,port1,etc] [target]

# nmap -PY 192.168.1.254
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:28 CDT
Interesting ports on home (192.168.1.254):
Not shown: 998 closed ports
PORT STATE SERVICE
80/tcp open
443/tcp open
http
https
MAC Address: 00:25:3C:5F:5A:89 (2Wire)
Nmap done: 1 IP address (1 host up) scanned in 0.79 seconds

 Performing a SCTP INIT ping


This discovery method attempts to locate hosts using the Stream Control
Transmission Protocol (SCTP). SCTP is typically used on systems for IP based
telephony.



note

The default port for -PY is 80. Others can be specified by using the following syntax: nmap -PY22,25,80,443,etc.

Nmap: TCP ACK Ping and UDP Ping (part-15)

TCP ACK Ping




The -PA performs a TCP ACK ping on the specified target.
Usage syntax: nmap -PA[port1,port1,etc] [target]

# nmap -PA 192.168.1.254
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:31 CDT
Interesting ports on home (192.168.1.254):
Not shown: 998 closed ports
PORT STATE SERVICE
80/tcp open
443/tcp open
http
https
MAC Address: 00:25:3C:5F:5A:89 (2Wire)
Nmap done: 1 IP address (1 host up) scanned in 0.81 seconds

Performing a TCP ACK ping


The -PA option causes Nmap to send TCP ACK packets to the specified hosts. This method attempts to discover hosts by responding to TCP connections that are nonexistent in an attempt to solicit a response from the target. Like other ping options, it is useful in situations where standard ICMP pings are blocked.
 
note
The default port for -PA is 80, but others can be specified using the 50 following syntax: nmap -PA22,25,80,443,etc.


UDP Ping

The -PU option performs a UDP ping on the target system.


Usage syntax: nmap -PU[port1,port1,etc] [target]

# nmap -PU 192.168.1.254
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:30 CDT
Interesting ports on home (192.168.1.254):
Not shown: 998 closed ports
PORT STATE SERVICE
80/tcp open
443/tcp open
http
https
MAC Address: 00:25:3C:5F:5A:89 (2Wire)
Nmap done: 1 IP address (1 host up) scanned in 0.81 second

Performing a UDP ping


This discovery method sends UPD packets in an attempt to solicit a response from a
target. While most firewalled systems will block this type of connection, some
poorly configured systems may allow it if they are only configured to filter TCP
connections.







note
The default port for -PU is 40125. Others can be specified by using the
following syntax: nmap -PU22,25,80,443,etc.

Nmap: TCP SYN Ping (part-14)

TCP SYN Ping

The -PS option performs a TCP SYN ping.
Usage syntax: nmap -PS[port1,port1,etc] [target]

# nmap -PS scanme.insecure.org
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-16 13:31 CDT
Interesting ports on scanme.nmap.org (64.13.134.52):
Not shown: 995 filtered ports
PORT STATE SERVICE
53/tcp open domain
70/tcp closed gopher
80/tcp open 113/tcp closed auth
http
31337/tcp closed Elite
Nmap done: 1 IP address (1 host up) scanned in 27.41 seconds

Performing a TCP SYN ping


The TCP SYN ping sends a SYN packet to the target system and listens for a response.
This alternative discovery method is useful for systems that are configured to block
standard ICMP pingsNote

.






Note
The default port for -PS is 80, but others can be specified using the

following syntax: nmap -PS22,25,80,443,etc.

Nmap: Ping Only Scan (part-13)

Ping Only Scan
 
The -sP option is used to perform a simple ping of the specified host.

Usage syntax: nmap -sP [target]

$ nmap -sP 192.168.10.2/24
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-08 20:54 CDT
Host 192.168.10.1 is up (0.0026s latency).
Host 192.168.10.100 is up (0.00020s latency).
Host 192.168.10.101 is up (0.00026s latency).
Nmap done: 256 IP addresses (3 hosts up) scanned in 3.18 second

Output of a ping only scan


This option is useful when you want to perform a quick search of the target network
to see which hosts are online without actually scanning the target(s) for open ports.

In the above example, all 254 addresses in the 192.168.10.0 subnet are pinged and
results from live hosts are displayed.
When scanning a local network, you can execute Nmap with root privileges for
additional ping functionality. When doing this, the -sP option will perform an ARP ping and return the MAC addresses of the discovered system(s).

Usage syntax: nmap -sP [target]

 

# nmap -sP 192.168.10.2/24
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-08 21:00 CDT
Host 192.168.10.1 is up (0.0037s latency).
MAC Address: 00:16:B6:BE:6D:1D (Cisco-Linksys)
...

Output of a ping only scan (as root)