Port scanner: Difference between revisions

UDP scanning is also possible, although there are technical challenges. [[User Datagram Protocol|UDP]] is a [[connectionless]] protocol so there is no equivalent to a TCP SYN packet. However, if a UDP packet is sent to a port that is not open, the system will respond with an [[Internet Control Message Protocol|ICMP]] port unreachable message. Most UDP port scanners use this scanning method, and use the absence of a response to infer that a port is open. However, if a port is blocked by a [[Firewall (computing)|firewall]], this method will falsely report that the port is open. If the port unreachable message is blocked, all ports will appear open. This method is also affected by ICMP [[rate limiting]].<ref name=profmesser1>{{cite book|last1=Messer|first1=James|authorlink1=|last2=|first2=|authorlink2=|editor1-first=|editor1-last=|editor1-link=|others=|title=Secrets of Network Cartography: A Comprehensive Guide to Nmap|trans-title=|url=http://www.networkuptime.com/nmap/page3-10.shtml|archiveurl=https://web.archive.org/web/20160516002101/http://www.networkuptime.com/nmap/page3-10.shtml|archivedate=2016-05-16|accessdate=2011-12-05|type=|edition=2nd|series=|volume=|date=|year=2007|month=|origyear=|publisher=|location=|isbn=|oclc=|doi=|id=|page=|pages=|deadurl=yes|dfurl-status=dead}}

Rarely used because of its outdated nature, window scanning is fairly untrustworthy in determining whether a port is opened or closed. It generates the same packet as an ACK scan, but checks whether the window field of the packet has been modified. When the packet reaches its destination, a design flaw attempts to create a window size for the packet if the port is open, flagging the window field of the packet with 1's before it returns to the sender. Using this scanning technique with systems that no longer support this implementation returns 0's for the window field, labeling open ports as closed.<ref name=profmesser2>{{cite book |last1= Messer |first1= James |title=Secrets of Network Cartography: A Comprehensive Guide to Nmap |url=http://www.networkuptime.com/nmap/page3-13.shtml |archiveurl=https://web.archive.org/web/20060201065451/http://www.networkuptime.com/nmap/page3-13.shtml|archivedate=2006-02-01|accessdate=2011-12-05 |edition=2nd |year=2007 |dead-url-status= yesdead }}

Despite this, the probability of a port scan alone followed by a real attack is small. The probability of an attack is much higher when the port scan is associated with a [[Vulnerability scanner|vulnerability scan]].<ref>{{cite web | first=Michel | last=Cukier | title=Quantifying Computer Security | publisher=University of Maryland | url=http://www.isr.umd.edu/research/research_briefs/Cukier_QuantCompSecurity.pdf | year=2005 | accessdate=2009-05-08 | deadurlurl-status=yesdead | archiveurl=https://web.archive.org/web/20090824155315/http://www.isr.umd.edu/research/research_briefs/Cukier_QuantCompSecurity.pdf | archivedate=2009-08-24 | df= }}</ref>