NMAP, which stands for “Network Mapper,” is an open-source tool utilized for network exploration or security auditing. It employs a variety of techniques to determine what hosts are available on the network, what services those hosts are offering, what operating systems they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Through IP Packets, NMAP establishes a map revealing service hosts and port numbers, reaching effective mechanisms to recognize a target’s available network services, its type of firewall, and even its operating system (OS) and version.
Conceptually, NMAP can be separated into three core stages: host discovery, port scanning and interference with the responding hosts. The first stage, host discovery, recognizes active hosts/devices on a network. NMAP does this by broadcasting an ARP request and waits for responses, tallying all the hosts that respond. In technical terms, NMAP changes the destination MAC address in an ARP packet to the broadcast MAC address to reach all machines on a LAN.
After host discovery, NMAP moves to the second stage – port scanning. In this phase, NMAP checks each device for open ports, these being potential communication entry points. NMAP performs this operation by sending a requested packet to each port, then based on the response (or lack thereof), it determines the status of the port – open, closed, or filtered. For instance, if a port responds with a TCP SYN-ACK packet, it is deemed open.
Finally, NMAP inspects the device further through version detection, OS detection and script scanning. This data is collected by sending specially crafted packets to the ports and interpreting the responses. These operations may involve everything from a simple banner grab to more detailed investigations using the NMAP Scripting Engine (NSE).
One example of its utilization includes system/network administrators who use NMAP for network inventory, managing service upgrade schedules, and monitoring host or service uptime. Another is that the NMAP tool is also beneficial in the black hat community of hackers and intruders who intend to exploit and corrupt system and network securities for malicious reasons.
NMAP is documented in a book “NMAP Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning” by NMAP’s original author, Gordon Lyon. This source and the NMAP official documentation (available at https://nmap.org/book/man.html) provide the ground for the information above.
In conclusion, NMAP is a potent tool in the hands of both system administrators aiming to secure their networks and hackers looking for vulnerabilities to exploit. Its efficiency lies in the sophistication and pack of methods it employs to map out networks, identify services and recognize potential weak points.
Sources:
1. Lyon, G. F. (2009). NMAP Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Nmap Project.
2. NMAP. (n.d.). NMAP – the Network Mapper. https://nmap.org/book/man.html.
