Overview of Network Scanning
Scanning is the process of gathering additional, detailed information about a target by using highly complex and aggressive reconnaissance techniques — it is the natural next step after footprinting. Where footprinting answers "what does this organization look like from the outside," scanning answers "what is actually alive and listening on the network right now."
Network scanning refers to the set of procedures used to identify hosts, ports, and services in a network. It is one of the most important phases of intelligence gathering for an attacker, because it lets them build a working profile of the target organization's infrastructure.
The purpose of scanning is to:
- Discover exploitable communication channels on the target
- Probe as many "listeners" (open ports/services) as possible
- Keep track of which ones are responsive or useful to the attacker's specific goals
During this phase, the attacker tries to find various ways to intrude into the target system and also looks for configuration lapses. Everything discovered during scanning then feeds directly into the attacker's overall attack strategy — scanning is the bridge between "recon" and "exploitation."
Why this phase matters
The more information an attacker has about a target, the greater the chance of finding a security loophole and gaining unauthorized access. Scanning is where footprinting's "big picture" turns into concrete, attackable details: specific IPs, specific ports, specific services.
Types and Objectives of Scanning
There are three broad categories of scanning, each answering a different question about the target.
Mnemonic — the 3 scan types
P-N-V = Port (which doors are open), Network (which houses are occupied), Vulnerability (which doors have broken locks). Think of scanning a street: first find which houses have people home (Network), then check each house's doors (Port), then check which doors have faulty locks (Vulnerability).
On OS fingerprinting
Port scanning doesn't just show "open" vs "closed" — the pattern of open ports and how the stack responds to crafted packets lets an attacker fingerprint the operating system itself, which then narrows down which known OS vulnerabilities to try.
TCP Communication Flags
The TCP header contains control flags that manage transmission of data across a TCP connection. There are six TCP flags total, and each one is exactly 1 bit — so the whole "Flags" section of the TCP header is 6 bits wide. When a flag's bit is set to "1," that flag is considered "on"/active.
The six flags split into two functional groups:
SYN — synchronize, initiates a connection.
ACK — acknowledges receipt
of data/a segment.
FIN — finish, gracefully terminates a
connection.
RST — reset, abruptly tears down a connection (often sent when a port is
closed).
PSH — push, tells the receiving stack to pass buffered data to the application immediately
rather than waiting to fill the buffer.
URG — urgent, marks the data in the segment as
urgent and to be processed ahead of other queued data.
Mnemonic — the 6 TCP flags
"Sam Always Fixes Routers, Please Urgently" = SYN, ACK, FIN, RST (the 4 connection-lifecycle flags), then PSH, URG (the 2 instruction flags). Note it's 6 flags = 6 bits, one bit each.
The TCP 3-way handshake
Normal TCP connection establishment (implied by "TCP/IP Communication" and used constantly by scanners like Nmap) uses SYN and ACK together:
Once all three segments have been exchanged, the connection is fully "established" (open). Scanners exploit this handshake directly: a full connect scan completes it, while a stealth/half-open scan deliberately stops after the SYN/ACK to avoid completing (and logging) a full connection. Crafting a packet with a specific, non-standard combination of these six flags set is exactly what the "Creating a Custom Packet Using TCP Flags" technique refers to — it's the basis for the more exotic scans below (Xmas, Inverse TCP, ACK-probe, etc.).
Scanning Techniques
Scanning is the process of gathering information about systems that are "alive" and responding on the network. Port scanning techniques help an attacker identify open ports on a target host; administrators use the same techniques defensively to verify their own security policies. The first step is always to check for live systems — only once live hosts are found does it make sense to hunt for open ports on them (since unnecessary open ports are exactly what attackers exploit to get in).
| Technique | How it works | Stealth level |
|---|---|---|
| ICMP Scanning | Sends ICMP echo requests (pings) to check which hosts on the network are alive/responding before doing any port-level work. | Low — easily logged/blocked by firewalls |
| Ping Sweep | Automates ICMP scanning across an entire range of IP addresses at once to build a list of live hosts (using ping-sweep tools such as Angry IP Scanner, SolarWinds, or nmap's -sn). | Low |
| TCP Connect / Full Open Scan | Completes the full 3-way handshake (SYN → SYN/ACK → ACK) with every target port. If it succeeds, the port is open. | Low — creates a full, logged connection |
| Stealth Scan (Half-open Scan) | Sends a SYN, and if a SYN/ACK comes back, immediately sends an RST instead of completing with ACK. The port is confirmed open but no full connection (and usually no log entry) is created. | High |
| Inverse TCP Flag Scanning | Sends probe packets with certain flags set (e.g. FIN, URG, PSH) and no response means the port is likely open; an RST response means closed. Relies on RFC 793 TCP behavior rather than a handshake. | High |
| Xmas Scan | Sets the FIN, PSH, and URG flags all at once ("lit up like a Christmas tree"). Closed ports reply RST; open/filtered ports typically stay silent. | High — but easily fingerprinted by modern IDS as anomalous |
| ACK Flag Probe Scanning | Sends packets with only the ACK flag set. Doesn't reveal open vs closed directly — instead it's used to map firewall rulesets: an RST reply means the port is "unfiltered," no reply (or ICMP unreachable) means "filtered." | Medium — used mainly for firewall/rule mapping |
| IDLE / IPID Header Scan | Uses a third, idle "zombie" host's predictable IP ID (IPID) sequence numbers to indirectly infer port states on the real target, without ever sending a packet from the attacker's own IP. | Very High — attacker's identity stays hidden behind the zombie |
| UDP Scanning | Sends UDP packets to target ports. Since UDP is connectionless, an ICMP "port unreachable" reply means closed; no response (UDP has no RST equivalent) usually means open or filtered — making UDP scans slower and less reliable to interpret. | Medium — slow and ambiguous, but often overlooked by defenders |
Mnemonic — remembering the technique list
"I Ping The Server, X-raying ACKs Idly, Under-cover" ≈ ICMP → Ping Sweep → TCP Connect → Stealth/Inverse-TCP → Xmas → ACK probe → IDLE/IPID → UDP. The scans get progressively stealthier and weirder as you go down the list — from "loud ping" to "hide behind a zombie host."
Countermeasures, Banner Grabbing & Network Diagrams
Port Scanning Countermeasures
Defenders reduce their exposure to scanning by:
- Deploying properly configured firewalls to filter/drop unsolicited probe traffic
- Running IDS/IPS to detect and block scan signatures (e.g. Xmas or NULL scans)
- Disabling or removing unnecessary services and ports so there's nothing to find
- Actively monitoring network traffic and logs for scanning patterns
- Configuring hosts to return misleading or generic banners so OS/service fingerprinting fails
- Segmenting networks so a scan of one segment doesn't reveal the whole environment
Banner Grabbing & OS Fingerprinting
Banner grabbing is the technique of connecting to an open service (e.g. via telnet or netcat to an FTP/HTTP/SMTP port) and reading the greeting text the service sends back — this banner often reveals the exact software name and version running.
Identifying the target system's OS (OS fingerprinting) combines banner text with subtler clues: how the TCP/IP stack responds to unusual flag combinations, default TTL values, window sizes, and which ports are open by default. Together these let an attacker (or a tool like Nmap with -O) guess the target's operating system and version with high confidence.
Drawing Network Diagrams
Once live hosts, open ports, and services are known, the results are assembled into a network diagram — a visual map of the target infrastructure. This turns a pile of scan output into an at-a-glance picture of the attack surface: which hosts talk to which, where the perimeter is, and which devices look most vulnerable or valuable.
Scanning Pen Testing
Scanning pen testing applies the standard penetration-testing methodology specifically to the scanning phase: it isn't just "run a tool," it's a structured process of checking live systems, enumerating ports/services, fingerprinting the OS, identifying vulnerabilities, and documenting everything found — always within the authorized scope of the engagement.
Check for live systems
Confirm which hosts in the target range actually respond (ICMP/ping sweep or TCP-based host discovery).
Check for open ports
Run port scans against each live host to enumerate open, closed, and filtered ports.
Fingerprint services and OS
Grab banners and analyze stack responses to identify exact service versions and the operating system.
Scan for vulnerabilities
Match discovered services/versions against known vulnerability catalogs.
Draw the network diagram & document
Compile findings into a network map and a report to hand off to the exploitation phase (or the client, in a legitimate pentest).
Nmap — Network Mapper
Nmap is one of the most widely used security tools in existence. It's a port scanner capable of performing many different scan types (TCP connect, SYN stealth, UDP, Xmas, ACK, and more — all the techniques covered above can be invoked as Nmap flags). It runs on Windows, Linux, macOS, and other platforms, and is available both as a command-line application and through its graphical front-end, Zenmap.
Command: nmap –sT 192.168.123.254 (the -sT flag runs a TCP Connect / full open scan)
Using Nmap: the three port states
Every port Nmap probes is reported in exactly one of three states:
Mnemonic — the 3 port states
"Open door, Closed door, Locked-and-guarded door" = Open (walk right in), Closed (door exists but nobody answers), Filtered (a guard/firewall blocks you from even knowing if anyone's home).
Other Scanning Tools
SuperScan
A Windows-based port scanner designed to scan TCP and UDP ports, perform ping scans, run Whois queries, and use Traceroute — an all-in-one GUI recon tool.
Scanrand
Scans a single host or very large networks. Uses stateless scanning to scan ports in parallel, making it extremely fast when huge numbers of IP addresses need to be scanned quickly.
THC-Amap
"The Hacker's Choice — Another Mapper." Stores a library of normal protocol responses to elicit replies from encrypted/obfuscated services, letting it find services that have been moved off their standard ports.
Mapping the Network
The end goal of scanning is a network diagram that shows vulnerable or potentially vulnerable devices on the target network. This can be done with automated tools or the old-fashioned way.
SolarWinds, Auvik, Open-AudIT, The Dude, Angry IP Scanner, Spiceworks Map IT, and Network Notepad — these auto-discover devices and render a visual topology.
Recording discovered info by hand in a notebook or spreadsheet — slower, but useful when tooling isn't available or a lightweight record is enough.
Analyzing the Results
Raw scan output is only useful once it's interpreted. The slides describe a simple 3-step analysis process:
Analyze the revealed services
Look at exactly which services were found running on each live host.
Explore vulnerabilities per service/system
For each service and system version identified, check for known weaknesses.
Research and locate potential exploits
Often done via a search engine — searching the OS and service/version to find public exploits that could be used against the system.
Exam Tips & Tricks
3 scan types
Port (open ports/services), Network (live hosts/IPs), Vulnerability (known weaknesses) — know which question each one answers.
6 TCP flags, 6 bits
SYN, ACK, FIN, RST (connection lifecycle) + PSH, URG (instructions). Each flag = 1 bit; the whole flags field = 6 bits.
3-way handshake
SYN → SYN/ACK → ACK. Full connect scan completes it; stealth (half-open) scan deliberately stops after SYN/ACK.
Xmas scan flags
Sets FIN + PSH + URG together ("lit up like a Christmas tree") — remember exactly these three flags, not all six.
Nmap example command
Know the exact syntax from the slides: nmap –sT 192.168.123.254 is a TCP Connect scan (-sT flag).
3 port states
Open (accepting connections), Closed (not listening), Filtered (firewall/filter blocking full determination).
IDLE scan = stealthiest
Uses a third "zombie" host's IPID sequence to hide the attacker's own IP completely from the target.
Tool name matchups
SuperScan = Windows GUI (TCP/UDP/ping/Whois/Traceroute); Scanrand = stateless, fast, large networks; THC-Amap = finds services moved off standard ports.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Scanning (definition) | Gathering detailed info about a target via aggressive recon techniques; bridges footprinting and exploitation. |
| Port Scanning | Lists open ports/services; enables OS fingerprinting and service/version identification. |
| Network Scanning | Lists live hosts, IP addresses, and open ports across the network. |
| Vulnerability Scanning | Scanning engine + catalog of known vulnerable files/exploits; finds known weaknesses. |
| TCP Flags (count) | 6 flags total, 1 bit each, 6-bit field: SYN, ACK, FIN, RST, PSH, URG. |
| Connection-lifecycle flags | SYN, ACK, FIN, RST — establish, maintain, and terminate connections. |
| Instruction flags | PSH (push data now), URG (mark data urgent). |
| 3-Way Handshake | SYN → SYN/ACK → ACK establishes a TCP connection. |
| ICMP Scanning | Pings hosts to check who's alive before port scanning. |
| Ping Sweep | Automated ICMP scan across an IP range; tools: Angry IP Scanner, SolarWinds, etc. |
| TCP Connect / Full Open Scan | Completes full 3-way handshake; reliable but loud/logged. |
| Stealth Scan (Half-open) | Sends SYN, gets SYN/ACK, replies RST instead of ACK — avoids full connection/logging. |
| Inverse TCP Flag Scanning | Uses flags like FIN/URG/PSH; no response often = open, RST = closed. |
| Xmas Scan | Sets FIN+PSH+URG together; closed ports send RST. |
| ACK Flag Probe Scanning | Maps firewall rules: RST = unfiltered, no reply = filtered (not open/closed). |
| IDLE/IPID Header Scan | Uses a "zombie" host's IPID sequence to scan without revealing attacker's IP. |
| UDP Scanning | ICMP "port unreachable" = closed; no reply = open|filtered (ambiguous, slow). |
| Port Scanning Countermeasures | Firewalls, IDS/IPS, disabling unneeded services, monitoring, misleading banners, segmentation. |
| Banner Grabbing | Reading a service's greeting text to learn its exact software/version. |
| OS Fingerprinting | Combines banners + stack-response quirks (TTL, window size, flag handling) to identify the OS. |
| Network Diagrams | Visual maps of discovered hosts/ports/services showing the attack surface. |
| Scanning Pen Testing | Structured workflow: live hosts → open ports → fingerprint → vulnerabilities → diagram/report. |
| Nmap | Network Mapper; widely used port scanner; CLI + Zenmap GUI; Windows/Linux/macOS. |
| Nmap syntax | nmap <IP address> <options>; example nmap –sT 192.168.123.254 (TCP connect scan). |
| Port states | Open (accepting), Closed (not listening), Filtered (firewall blocking determination). |
| SuperScan | Windows GUI: TCP/UDP scans, ping scans, Whois, Traceroute. |
| Scanrand | Stateless, parallel scanning; fast across huge IP ranges. |
| THC-Amap | Finds services redirected off their standard ports via signature matching. |
| Mapping tools | SolarWinds, Auvik, Open-AudIT, The Dude, Angry IP Scanner, Spiceworks Map IT, Network Notepad. |
| Manual maps | Recording scan data in a notebook or spreadsheet. |
| Analyzing results (3 steps) | Analyze revealed services → explore vulnerabilities → research/locate exploits (often via search engine). |