‫Since Cannes is the default and the most popular scan option for good reasons, it can be performed
‫quickly, scanning thousands of ports per second on a fast network not blocked by restrictive firewalls.
‫It's also relatively stealthy since it never completes TCP connections.
‫It also allows clear, reliable differentiation between open, closed and filtered states.
‫This technique is often referred to as half open scanning because you don't open a full TCP connection.
‫You send us in packet as if you're going to open a real connection and then wait for a response.
‫A cynic indicates the board is listening or open while a wrist reset is indicative of a non listener.
‫If no response is received after several retransmission or an ICMP unreachable error is received, the
‫board is marked as filtered.
‫If you receive a snack from the target system, you send receipt instead of the egg packet and you do
‫not complete the three way handshake.
‫OK, so let's perform an end map sin scan in our virtual network.
‫Go to Carly and open the terminal screen.
‫First, let's look at the IP address of Carly to understand the IP block.
‫Here's my IP block is one seven two one six nine nine.
‫Is it because that netmask is 255.255.255.0?
‫I don't want to go further in a network basics in this.
‫You know what?
‫OK, fine.
‫I'm going to add an IPv4 document to the course resources.
‫You can look it up there.
‫Now let's create this in scan command and map is the command itself.
‫S capital s is to since scan, since it's the default scan type for privileged users, and I'm already
‫a privileged user and colleague.
‫This parameter is not necessary for a sentence can.
‫Now here is a target IP block.
‫One seven, two one six nine nine zero 24.
‫As we talked about before, remember this is the IP address block from one seven two one six nine nine
‫zero right the way through one seven two one six nine nine two five five.
‫And let's give it a fast scan for just a top 50 ports.
‫I use top ports parameter for this purpose and hit enter.
‫Now, let's look at the scan results.
‫Here we have the computers who have the IP addresses one seven two one six nine, nine point one and
‫two.
‫These are the Gateway and the DNS server for my virtual network VM.
‫Ignore them for now.
‫In fact, one is my host machine at the same time.
‫Here there is a system and the open ports are in the top 50.
‫Well, look, there's another machine and of course, it's open ports.
‫The machine with IP 254 is the DHC server of my VM that so ignore that as well.
‫And the last machine found is the collie itself.
‫OK, let's open Wireshark and see what's happening when a Sen scan is performed.
‫Run Wireshark first double click if zero to start to listen to that interface now to skip the packets,
‫which we are not interested in.
‫I had a filter.
‫I only want to see the traffic for my destination computer.
‫One seven two one six nine nine eight one three nine.
‫And I want to see the TCP traffic only.
‫Click the blue arrow next to the filter bar to activate the filter.
‫OK, now go to the terminal screen.
‫I'd like to analyze this in scan packets for an open port first one seven two one six nine nine one
‫three nine is my destination system.
‫And I know that Port 80 of that system is open.
‫Hit, enter and run the map query.
‫Yep, the port is open, just as I remember.
‫So now go back to Wireshark.
‫I want to stop Wireshark by clicking the Red Square, the upper left corner, to avoid unwanted packets.
‫So here we have three packets.
‫The first packet is from an arbitrary port of call to the 80th port of the system one three nine.
‫The destination system it is a send packet to start the three way handshake.
‫The second packet is a snack sent by the destination system.
‫The third packet is a receipt sent by Colley because it's a sin scan.
‫The three way handshake is not completed and corrupted by a risk packet.
‫Now I restart the Wireshark packet, capturing to clean it screen by clicking the upper left blue button.
‫OK, so this time I scanned a closed port, for example, Port 81.
‫Now, the first packet is a SoundScan packet to start the three way handshake again.
‫The sewer system is Carly and the destination system is again one three nine.
‫The second packet is for the scan, a receipt packet because Port 81 is closed.
‫The destination system sent us a receipt packet.
‫Let's see how Nmap interprets the results of Sen Scan.
‫When we send a send back, the destination system replies a snack packet to show that it's ready for
‫a connection.
‫And we send risk to corrupt the handshake and map interprets this result as.
‫The port is open.
‫If the destination system replies a receipt packet for our sign packet, that means.
‫The board is accessible, but it's closed.
‫If the destination system doesn't respond to our sin packet.
‫And Matt thinks that the packet has dropped or filtered.
‫It's a common behavior of the firewalls.
‫If the destination system replies and ICMP unreachable packet for us in packet again, it's interpreted
‫as filtered.
‫This is another type of firewall behavior.