Nmap, also known as Network Mapper, is a free and open-source utility used by IT professionals and cybersecurity experts for network discovery and security auditing. Nmap can be used to discover hosts and services on a computer network and create a map of the network. One of the scanning techniques that Nmap can perform is packet size scanning, allowing users to define the size of the payload sent to the target.
Before we discuss how to use Nmap for packet size scanning, it’s important to note that scanning methods can be intrusive and you must ensure you follow relevant laws and guidelines regarding ethical hacking and network scanning.
Using Nmap for packet size scanning involves defining the size of the payload with either the —data-length option for UDP, TCP, and ICMP packets, or the —mtu option for ICMP and IP packets.
The —data-length option allows users to add random data to the sent packet, increasing the size of the packet. This is useful for evading firewalls or intrusion detection systems (IDS) that only check the header of packets. This can be done as follows: `nmap —data-length 25 192.168.1.1`. This command will scan the host 192.168.1.1 with a 25-byte payload added to the sent packet.
The —mtu option allows users to specify the Maximum Transfer Unit (MTU) size of the sent packets. By setting the MTU value, Nmap will only send packets that are a multiple of the specified number. This can help evade firewalls or IDS that struggle with fragmented packets. An example command would be: `nmap —mtu 24 192.168.1.1`. This command would send packets to the host 192.168.1.1 that have a size that’s a multiple of 24.
Both of these techniques can be beneficial when scanning a network for security vulnerabilities, as altering the packet size can help evade detection and reach otherwise inaccessible network segments. However, altering the packet size too drastically can slow down the scan or potentially crash the target host, so care should be taken when adjusting these settings.
Please refer to the official Nmap documentation for additional in-depth explanations of these commands and their use cases(https://nmap.org/book/man.html).
Lastly, it’s worth repeating that these techniques should be used responsibly and within the boundaries of the law. It’s always best to have explicit permission before conducting any network scanning activities.
Sources:
1. Nmap Network Scanning: Official Nmap Project Guide to Network Discovery and Security Scanning, Gordon Lyon, 2008.
2. Nmap Man Page: https://nmap.org/book/man.html
3. Metasploit: The Penetration Tester’s Guide, David Kennedy et al., 2011.
