Questions about nmap

Question

I have several questions about nmap. First, nmap can detect servers via:

• link-layer
• network-layer
• transport-layer

What are the differences (not in the layer, but in the way that nmap does it) and how does nmap do this?

Second, when I port scan with nmap, the UDP scan takes much longer then the TCP scan. Why?

Third: are there any different methods to explore the OS then to use the -O --osscan-guess command (I mean totally different, not e.)?

Answer 1

I can address your third question.

One totally different way to identify an operating system is using Michal Zalewski's p0f. p0f guesses operating systems based on particular flags and other characteristics of TCP packets that pass by. A SYN packet from an incoming connection is enough to make a guess. The "fingerprint" file from Zalewski's site is kind of old. Newer fingerprint files exist.

Answer 2

I assume that you don't want to look into the source code because of its complexity. A book that describes in a simple way how nmap functions and what are the differences between its scanning techniques is Secrets of Network Cartography: A Comprehensive Guide to nmap (available online for free). For more documentation, check the docs on nmap.org

Answer 3

The short answers to your questions are below. The long answer is, "read the manpage." The Really Long Answer is, check out the source code.

1. Host discovery ("detect servers")

   For hosts on the same link as the scanner, Nmap uses ARP requests to determine the link-layer address of each IP address being scanned. Any positive reply is taken to mean that the host is up. The --send-ip option can be used to override this behavior.

   For all other hosts, Nmap uses a combination of ICMP and TCP packets to attempt to solicit a response. This could be described as "network-layer" or even "transport-layer" discovery. Briefly, an ICMP Echo request should produce a Echo response, a TCP SYN should produce a TCP SYN-ACK or RST, a TCP ACK should produce a TCP RST, and an ICMP timestamp request should produce a timestamp response.

2. UDP takes longer to scan because an open port does not have to return a reply. TCP scans can expect an immediate reply, whether open or closed, for each port that is not firewalled (filtered). UDP scans get the same reply for open and filtered ports (with some exceptions. See the documentation on UDP payloads). Furthermore, many hosts rate-limit the closed-port response (ICMP port unreachable response), so even closed ports can only be determined slowly.

3. Some services running on a target system can divulge the Operating System, so running a service version scan (-sV) could give that information. Also, many of the NSE scripts that come with Nmap can get similar information. However, these methods are often less reliable than using -O, and depend on particular services being available.