Hello everyone and welcome to this nmap
course.
In this video we are going to learn about nmap
scan types.
So there are many type of scan types which
are used for our scanning in
and map like sin act zombie
scan null scan. Xmascan TCP
scan UDP scan and fence can.
So let's start with the first scan, which
is TCP connectscan. The syntax
of this scan is nmap hyphen
St. The target IP and
the port you want to scan.
the TCP connect scan completes the three-way
handshake
if a port is open the operating system completes the
tcp-3 way handshake and the port scanner immediately
closes the connection to avoid dos.
This scan is noisy because the services can
lock the sender's IP address and they might
trigger IDs.
And IPS on the systems.
So what actually happens in
this scan?
As you can see on the left hand side is the unmarked
machine and on the right hand side is the
server which we are going to scan.
The first request our nmap is going to send is
the send request then the server
is going to reply for that with a syntax.
And finally and map will send an
acknowledge package to the server to acknowledge
it and then will reset the packet.
Let's understand the Wireshark packet breakdown
of TCP connect scan.
As you can see there is syn, Packet synac
and AC which is happening successfully
after that a reset has
been sent.
So here we can conclude that TCP connect
scan utilizes TCP 3-way
handshake in background as we
saw into this packet.
So what are the pros and cons of this scam?
The advantage is it is quite reliable scan
on TCP ports.
The disadvantage is it is less still
the as the connection attempts will be logged by
the server and it takes longer time to
send more packets.
So it is the Practical time and let's see the Practical
of TCP connect scan.
So as you can see over here.
I'm going to write the command, which is nmap.
And the flag hyphen s t and
the target IP address that I want
to scan.
After giving the target IP address. I'm going
to add hyphen V to see the output in
verbose mode.
Onto my screen.
Remember in the background. I am running Wireshark to
capture all the packets to see what actually
and map is doing in the background.
So as you can see I have started the scan.
And it has already identified two
open ports, which is 445 and 7 0
7 0 as you can see over here and it
has also identified one more Port 808.
If you notice closely, you can read over here initiating
and connect scan, which is a TCP connect
scan.
It is also identified that the host is up.
Now. Let's see the analysis in Wireshark
that what actually happened. We have
already seen the packet image in the
previous slide. Now. Let's see the life packet
analysis of TCP connect scam.
So in the Wireshark, I'm going to type
ip.edr equals equals
and the target IP address that I
want to see the packet for this is the filter in
which I just want to see the packets which are
sent to this particular IP address.
I will just scroll down.
Let me scroll more down to see a TCP three-way
handshake has been created with the
target IP address.
Perfect, as you can see over here, we identified that
the port number 88 was open
and a tcp3 way handshake
has been successfully performed and the port status
was identified as open.
If we look closely you can see first a
sin packet has been sent and then a synac
has been sent and finally an acknowledged has
been sent.
As you can see over here Port 88 was identified
as open as we saw a complete
tcp3 way handshake was performed
and the status was identified by nmap.
I hope you guys understood this.
Thank you.