Pink scans are a valuable method for determining if a host is online and responsive.
While traditional TCP ping scans are commonly used, UDP ping scans offers an advantage by being able
to detect systems behind firewalls with strict TCP filtering, but have left UDP exposed.
In this lecture we will explore how to perform a UDP ping scan using Nmap and its related options.
So let's initiate a UDP ping scan.
You will open your terminal here and let's clear that.
So now we will enter the nmap as n here pu here with po option, with uppercase here.
And after that we will enter the code silicon.
And here, as you can see here, only works if you are root.
So we will use the sudo here.
Sudo enter the password and that's it.
So here this command instructs nmap to perform host discovery using udp ping scanning.
And here let's take another look by scanning the target scan me.nmap.org here.
So we will delete the code Silicom and scan me.
Scan me.nmap.org here.
So now we are scanning scan me dot.
Dot org.
And as you can see here there is zero host is up here because host seems um so if it is really up with
blocking our pink props and here as you can see here in my password gives it gives us an suggestion
here so.
Now, as you can see here, host is up and other addresses for scan me which are not scanned.
This is the IPV IP version six address here.
So after executing this command Nmap provider scan report indicating whether the target is host is online,
Additionally, it might display alternative IP addresses associated with the target, for instance,
this year.
So we will also test it with the code Silicom code Silicom here and now what we're going to see is and
as you can see here, we have our address here, address and so on.
So let's actually think about how it works.
So UDP ping scanning operates by sending an empty UDP packet to the target port.
If the host is online, it should respond with an ICMP port unreachable error.
On the other hand, if the host is offline, various ICMP ICMP messages may be returned.
So we will try that again and we will enter some weird.
Here.
Most.
Here and now.
No targets are specified and so on.
So because it couldn't resolve this.
So we will we can give 111 here and in this case.
And as you can see, it is cost is down.
So and it's worth noting that open ports that do not respond to empty UDP packets can generate false
positives, as you can see here during the scan.
So service is running on these ports might simply ignore the UDP packets leading to incorrect offline
status for the host.
And as you've seen in previous lectures in previous examples here.
So when we entered this to console.com, the Encode cell in reality is actually up.
So it's running.
But here it's as you can see in set that it's down.
So to improve the accuracy of the scan results, selecting closed ports as targets can be beneficial.
So to specify the ports to be probed in UDP ping scans, you can add a port list or range after the
p u option here.
So we will delete the s n now because of that and after that we will after p u here without spaces,
we will enter from 0 to 1500 here.
So now it will scan the com port UDP port and send requests from one zero here and to 1500.
So now we are waiting for it.
And as you can see, it's almost done 17%, 13.
1450.
Almost 60 here.
And here.
So while this loading, we can go to another example here.
So pink scans are commonly used to determine the online status of a host and ICMP echo request messages
specifically designed for these purposes so and are employed in ICMP ping scans to reliably detect a
host status.
So in this lecture we will explore how to perform an ICMP ping scan using Nmap and flags associated
with the different types of supported ICMP messages.
So here, let's see the output here.
And as you can see, it's almost done.
And you see here we have open ports and services listed here and also our DNS record.
So let's delete this and we will.
We will execute another scan here and a map here and after that code.
So now what we are doing here is we are initiating an ICMP ping scan.
And here, as you can see here, using TCP mixer rather than ICMP.
So that's why we need to run it with Sudo.
And here we will get an output here, almost done.
So this command instructs Nmap to send an ICMP echo request packet to the specified target.
So here we will also do another example with the scan me.nmap.org.
After initiating this and completing this scan here, it's almost done.
Just a 20% left.
And as you can see here, undergoing a scene stealth scan.
And it's a stealth scan timing.
It's 7% almost and done.
And here we also got this.
Here we have the DNS record again and so on.
So we will Now what we're going to do is we will execute the same.
Scan me scan me.nmap.org website and here.
Upon executing the command, Nmap will provide a scan report indicating whether the host is responding
as it did here.
So additionally, it may display the latency and other relevant information.
For example, this here and so on.
So let's actually now let's go to think about how it works here.
So the SDN.
Here, the s, n, P or P option.
These racks and map to send an ICMP echo request package to the target host.
So if the host responds with an ICMP echo reply, we can determine that it is online.
So by utilizing the this packet trace.
Packet trace option, we can gain insights into underlying process here.
And I have.
I also have some additional insights to hear.
So ICMP ping scanning supports various ICMP message types, although remote ICMP traffic is typically
blocked, so it's commonly logged within local network.
So to explore more ICMP ping scan configuration options, refer to the documentation and resources available
for Nmap.
And here we also have the local versus remote network.
So it's important to keep in mind that while ICMP ping scans can be useful for monitoring local networks,
remote ICMP packets are often blocked by system administrators, so therefore their effectiveness may
vary depending on the other network configuration.
And in addition to the ICMP echo request, the other ICMP messages can also be employed for host discovery
and Nmap supports ICMP timestamp reply, which is uppercase p p here.
So let's also try it p p here.
And this is the address.
And we also can use the address mask reply p m messages as alternative techniques.
So these variations can bypass misconfigured firewalls that only block ICMP echo requests.
So to perform the scans using these ICMP types, you can use this command, as you can see here, p
p.
So we will add the packet trace to see what's going on under the hood.
And after that we will use the P here since we executed already here and now they're seeing.
Uh, as you can see, host seems down because in this website we have a firewall and it also blocks
this ICMP ping scan and different ICMP echo request here.