When you use NMAP (Network Mapper) to scan a target, the target may or may not be aware of what you’re doing based on their monitoring and security measures. NMAP is a free open-source application used for network scanning and security auditing. It’s a powerful tool, often utilized by security specialists to discover hosts and services on a computer network.
NMAP sends packets to the target system and then analyzes the responses to create a map of the target’s network (Mev, 2019). Theoretically, if someone is monitoring the incoming and outgoing traffic to the system being scanned, they could potentially detect that an NMAP scan is being conducted.
The detection typically depends on how sophisticated the target’s Intrusion Detection System (IDS) is (Lyon, 2008). Intrusion Detection Systems are designed to detect suspicious activities and alert the system administrator, and they can potentially detect an NMAP scan if it’s not sufficiently stealthy.
NMAP does offer some stealthy scanning tools to bypass Intrusion Detection Systems, including techniques such as decelerating the scan to evade detection (‘slow scan’), fragmentation of packets (NMAP, 2020), or using decoys to make it appear as though the scan is coming from multiple sources (Protalinski, 2012). However, even these methods may not avoid detection completely, especially against advanced IDS.
For example, a research published in the Journal of Cyber Security Technology compared different IDS and found that some IDS like Snort, Suricata & Bro are capable of detecting different NMAP scanning techniques (Patrot & Sachdeva, 2019). These IDS can detect not only common scanning techniques like TCP Connect scanning or SYN scanning but also more stealthy techniques such as Null, FIN or Xmas scans.
So, while it’s possible to scan stealthily using NMAP, it’s not guaranteed that your target will not know you’re scanning them. It depends on the sophistication of their security system and their network monitoring practices.
Sources:
- Mev, T. (2019). Network Scanning: Working with NMAP. Towards Data Science. https://towardsdatascience.com/network-scanning-3b6fd1e40ddd
- Lyon, G. (2008). NMAP Network Scanning. NMAP.org. https://nmap.org/book/man.html
- NMAP. (2020). Idle Scan. NMAP. https://nmap.org/book/idlescan.html
- Protalinski, E. (2012). How to use NMAP: More port scanning techniques. ZDNet. https://www.zdnet.com/article/how-to-use-nmap-more-port-scanning-techniques/
- Patrot, A., Sachdeva, S. (2019). Comparative Analysis of NMAP with Different IDS. Journal of Cyber Security Technology. https://www.tandfonline.com/doi/full/10.1080/23742917.2019.1652254
