Section 3 troubleshooting issues with network scanning.
Welcome to the video monitoring and map scans using verbose logging in this video we will troubleshoot
issues that may arise from scanning in a dual home environment where both are wired and wireless interfaces
are active.
We'll also turn up the verbosity of logging on our unmap scans so we can see what's happening in real
time.
And we'll also learn about debugging the output of our scans for extreme situations such as.
If you think you've discovered a bug and map itself when you start scanning your own corporate network
or networks for other customers you probably aren't going to be scanning just a single subnet like we've
been doing in some of our examples.
You might be scanning hundreds or thousands of systems.
So it's important to be able to monitor and troubleshoot scans and figure out if issues reside on the
end points you're scanning or on your local system.
So you can identify potential issues.
Let's start with an example and say that you've been hired to do some network scanning for a client
and they want an inventory of all systems across their land as far as IPs open ports software versions
etc..
So they give us a list of class C subnets which we save into a file called subnets sticks.
Great.
Now before we conduct our scan let's look at our interface list using and map space tak tak I-F list.
This command came in handy a few years ago where I was connected to the customer's network on my wired
interface.
But a Wi-Fi hotspot on my wireless interface so to make sure I was doing all my scanning sourced out
of the ether zero or wired interface I ran my scans like this and map space tak e E-3 0 and then my
target's.
So this is a handy command syntax to know if you find yourself in a similar situation in the future
OK.
Let's get back to the task at hand and start scanning these sediments now to get the most thorough results
possible.
Let's do a full scan of all 65000 plus TCAP ports which will specify by using TAC P Plus the port range
we want to scan know that there is not a space between Ptak P and the first number of our port range
and then finally we'll use the TAC lowercase i.
Capital L Flegg and specify our list of subnets in the subnets at textfile.
OK so great.
The scan is running at least we think it is.
Right.
Without any output it's difficult to say if the scan will finish in 10 minutes 10 hours or even 10 days.
So let's cancel out of this scan with control plus see and turn up logging so we have a better idea
of what's going on behind the scenes.
I'm going to run the exact same command again but add a space TAC V flag at the end.
The V stands for verbosity.
There are nine levels of verbosity which you can turn up by adding additional vees or you can use the
plus a number like V-2 to call the level directly.
It's good to know that the map reference guides says verbosity levels greater than two really aren't
that useful.
But let's turn verbosity up to two so to speak and see what happens.
Now we get a much more lively status showing us what system is being scanned.
The ports identified as being opened and a rough approximation as to how long our scan will take to
finish.
I wouldn't plan your day around this time estimation necessarily but it should at least give you an
idea of whether or not the scan will finish in your lifetime.
Now if for some reason verbose mode doesn't provide sufficient information for you debugging mode is
available to floody with even more data just like the tech v option for verbosity.
Debugging is enabled with a command line Flegg TAC D and can also be called directly by calling the
TAC D.
Multiple times.
Note that the folks at end maps say debugging output is useful when you suspect you found a bug in and
map or if you're just confused about what and map is doing and why.
So be warned that the debugging feature is mostly intended for developers and the debug lines aren't
always self-explanatory.
If you don't understand align your best options really are to look it up in the source code or request
help.
The end maps mailing list.
Since we're talking about getting help if you're having an issue with a map or a specific scan it's
a good idea to periodically run and map space TAC V to see what version of end map is installed.
I've got 7.6 0 installed here and if we do a quick spot check on and mapped out.
It appears that indeed the latest version is 7.6 0.
Or if you're just not sure if the version you have is the latest.
It doesn't hurt to run an apt get update an apt get upgrade to pull down all the latest package updates
from the Kalli repositories because and map updates will be included in that action in our next video.
We need the latest version because you can acquire permissions from your clients and cloud vendors to
ensure the scanning work you do is properly documented and approved by the necessary parties.