Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This was a question on my study guide, and I believe that the script is pinging the ip addresses, so the 2nd choice. Can somebody confirm this for me?

The 5th column of NMAP output below is the IP address. Armed with that information, what does the script below do?

nmap -n -p80 -sS -PN --open 192.168.1.0/24 | grep "Nmap scan report" | awk '{print $5}' | while read IP; do ping -c 1 $IP && echo "I can ping $IP" ; done

Select one:

  • It will resolve the network names of the hosts running web servers

  • It will ping all of the IP addresses between 192.168.1.0 and 192.168.1.255

  • It will search the network for Telnet servers

  • It will see if ICMP ECHO REPLY is returned from all hosts running web servers in the 192.168.1.1-255 range

  • It will connect to every web page on the network and download the banner

share|improve this question

closed as off-topic by jasonwryan, Chris Down, slm, 1_CR, Anthon Dec 20 '13 at 6:01

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – jasonwryan, Chris Down, slm, 1_CR, Anthon

2 Answers 2

up vote 2 down vote accepted

Firstly, I like to check the linux man(ual) pages for questions like this. Also of note, is that this script uses piping: http://en.wikipedia.org/wiki/Pipeline_%28computing%29

For example, by opening terminal and typing man nmap, we can see what nmap does and what each argument means

From the man page for nmap

Nmap (“Network Mapper”) is an open source tool for network exploration
       and security auditing.

-n/-R: Never      do DNS resolution/Always resolve [default: sometimes]
-p <port ranges>: Only scan specified ports
-sS/sT/sA/sW/sM:  TCP SYN/Connect()/ACK/Window/Maimon scans
-Pn (No ping) .   This option skips the Nmap discovery stage altogether.
--open            (Show only open (or possibly open) ports) .

So, from that, it seems we're doing some kind of scan without DNS resolution, only on port 80, with a SYN packet and while skipping the discovery stage. Also, it seems we're only interested in open ports, and we're doing this for everything that seems to match 192.168.1.*.

This is because the address is 192.168.1.0/24, where 24 corresponds to the number of bits in the IP (Another lesson!). 192.168.1.1/16 would mean anything on 192.168.., 192.168.1.1/8 would mean anything on 192...*, and so on.

Grep will scan the input and print out the lines that match your query. In this case, it will run through everything that Nmap tells you, and print only the lines that contain "Nmap scan report".

When I run:

    sudo nmap -n -p80 -sS -PN --open 192.168.1.1 | \
       grep "Nmap scan report" 

the result is: "Nmap scan report for 192.168.1.1"

From there, the line "Nmap scan report for 192.168.1.1" gets pushed into the awk input. From the manpage: "mawk - pattern scanning and text processing language"

In this context, awk is taking the "Nmap scan report for 192.168.1.1" that I mentioned, and isolating just the IP address. Indeed, we can cheat a little bit by testing this in terminal:

    echo Nmap scan report for 192.168.1.1 | awk '{print $5}'

will spit out: 192.168.1.1

Now, there's the while loop going on:

    while read IP; do ping -c 1 $IP && echo "I can ping $IP" ; done

The while loop says, while there's an IP to be read, ping it -c times (in this case, one), and (&&) print to the command window (echo) "I can ping <IP>", before that iteration of the loop comes to an end. What does ping do?

Let's check the manpage: "ping, ping6 - send ICMP ECHO_REQUEST to network hosts"

So for all of the IP addresses that nmap determined had open ports 80, the computer should ping (send an ICMP ECHO_REQUEST) each once and print that it has done so.

Now, port 80 is used for HTTP traffic, in other words, web server type stuff. Because nmap has been told to look at open port 80, a host (internet enabled computer) with a closed port 80 will be ignored. For that reason, I would say your best bet is likely "It will see if ICMP ECHO REPLY is returned from all hosts running web servers in the 192.168.1.1-255 range."

share|improve this answer
    
Thank you for your help in explaining –  Garbth Bobby Dec 20 '13 at 3:45

It's the fourth choice.

Web servers listen on port 80 by default, and that's where -p80 in the nmap command line comes into play. In other words, it's looking for hosts that have port 80 open and seeing which of these will reply to an ICMP ECHO request, otherwise known as a ping.

share|improve this answer
    
Thank you very much sir –  Garbth Bobby Dec 20 '13 at 3:09
    
@GarbthBobby You are quite welcome. –  Joseph R. Dec 20 '13 at 3:09
    
If you could answer any of these that would be very helpful as well serverfault.com/questions/562648/… @Joseph R. –  Garbth Bobby Dec 20 '13 at 3:10
    
@GarbthBobby Sorry, I have zero experience with PowerShell. –  Joseph R. Dec 20 '13 at 3:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.