Overview The TCP protocol: quick overview Scanning Fingerprinting OS Detection.
The TCP Protocol Transmission Control Protocol (the transport layer of the Internet). Connection oriented. Reliable. Point-to-point Flow control
TCP Overview application transport network data link physical application transport network data link physical network data link physical network data link physical network data link physical network data link physical network data link physical logical end-end transport
Flags FlagDescription URG The value of the urgent pointer field is valid. ACK The value of the acknowledgment field is valid. PSH Push the data. RST The connection must be reset. SYN Synchronize sequence numbers during connection. FIN Terminate the connection.
Some Well Known Ports PortProtocolDescription 7Echo Echoes a received datagram back to the sender 9Discard Discards any datagram that is received 11Users Active users 13Daytime Returns the date and the time 17Quote Returns a quote of the day 19Chargen Returns a string of characters 20 FTP, Data File Transfer Protocol (data connection) 21 FTP, Control File Transfer Protocol (control connection) 23TELNET Terminal Network 25SMTP Simple Mail Transfer Protocol 53DNS Domain Name Server 67BOOTP Bootstrap Protocol 79FingerFinger 80HTTP Hypertext Transfer Protocol 111RPC Remote Procedure Call
Scanning Objectives: Determining if the system is alive. Determining if the system is alive. Determining which services are running or listening. Determining which services are running or listening. Detecting the operating system. Detecting the operating system.
System Alive? The major technique is to use ping sweeps or similar techniques. Tools such as fping or supersacn may be used.
What processes are running or listening? Identify both TCP and UDP services running on the target system. Identify applications or versions of services running.
Detecting OS The major technique is known as stack fingerprinting. The general idea is to send packets to the target and analyze the reply. Operating systems differ in their implementation of TCP/IP protocol stack.
Examples FIN probe: OS’s differ in their response to a FIN packet. TCP initial window size: unique for some implementations.