Discovering hosts with ICMP ping scans_Nmap 6：Network exploration and security auditing Cookbook-QQ阅读中文玄幻网

上QQ阅读APP看书，第一时间看更新

Discovering hosts with ICMP ping scans

Ping scans are used to determine if a host is online and responding. ICMP messages are used for this purpose, and hence ICMP ping scans use these types of packets to accomplish this.

The following recipe describes how to perform an ICMP ping scan with Nmap, and the flags for the different types of ICMP messages.

How to do it...

To make an ICMP echo request, open your terminal and enter the following command:

# nmap -sP -PE scanme.nmap.org

If the host responded, you should see something similar to this:

# nmap -sP -PE scanme.nmap.org 


Nmap scan report for scanme.nmap.org (74.207.244.221) 
Host is up (0.089s latency). 
Nmap done: 1 IP address (1 host up) scanned in 13.25 seconds

How it works...

The arguments -sP -PE scanme.nmap.org tell Nmap to send an ICMP echo request packet to the host scanme.nmap.org. We can determine that a host is online if we receive an ICMP echo reply to this probe.

SENT (0.0775s) ICMP 192.168.1.102 > 74.207.244.221 Echo request (type=8/code=0) ttl=56 id=58419 iplen=28 
RCVD (0.1671s) ICMP 74.207.244.221 > 192.168.1.102 Echo reply (type=0/code=0) ttl=53 id=24879 iplen=28 
Nmap scan report for scanme.nmap.org (74.207.244.221) 
Host is up (0.090s latency). 
Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds

There's more...

Unfortunately, ICMP has been around for a pretty long time, and remote ICMP packets are now usually blocked by system administrators. However, it is still a useful ping technique for monitoring local networks.

ICMP types

There are other ICMP messages that can be used for host discovery, and Nmap supports the ICMP timestamp reply (-PP) and address mark reply (-PM). These variants could bypass misconfigured firewalls, which only block ICMP echo requests.

$ nmap -sP -PP <target>
$ nmap -sP -PM <target>