Aim: Study a wireless network Security tool like Nmap.
Nmap
Introduction to Nmap
Nmap (Network Mapper) is an open-source tool used for network discovery
and security auditing. It helps identify devices connected to a network and
determines which services are running on those devices. Nmap works by
sending specially crafted packets to target systems and analyzing their
responses.
Nmap can detect open ports, running services, operating systems, and network
paths between systems. Because of these capabilities, it is widely used by
network administrators and cybersecurity professionals for monitoring network
security and detecting vulnerabilities.
The tool supports multiple operating systems such as Windows, Linux, and
macOS and can scan thousands of devices quickly.
1. Tools / Components in Nmap
Nmap provides several built-in features that help analyze networks.:
1.1 HOST DISCOVERY
Host discovery identifies active devices on a network.
• Detects whether a system is online
• Uses techniques like ICMP ping and TCP ping
• Helps locate active hosts before scanning ports
1.2 PORT SCANNING
Port scanning identifies open ports on a target system.
• Detects open, closed, or filtered ports
• Shows which services are available on the system
• Helps identify potential security risks
1.3 SERVER VERSION DETECTION
Nmap can identify the software and version running on open ports.
• Detects web servers, FTP servers, and database services
• Helps identify outdated or vulnerable software
• Useful for security auditing
1.4 OPREATING SYSTEM DETECTION
Nmap can determine the operating system of the target device.
• Uses TCP/IP fingerprinting techniques
• Compares responses with known OS patterns
• Helps identify system environments
2. Applications of Nmap
Nmap is widely used in many networking and cybersecurity applications.
Network Security Testing
• Detects open ports and vulnerable services
• Identifies security weaknesses
• Verifies firewall configurations
Penetration Testing
• Used by ethical hackers to test network security
• Identifies system vulnerabilities
• Helps simulate cyber attacks
Network Monitoring
• Detects unauthorized devices connected to the network
• Monitors network activity and services
Network Inventory
• Identifies devices connected to a network
• Detects operating systems and services running on them
Academic and Research Use
• Teaching networking and cybersecurity concepts
• Analyzing network behavior
• Studying protocol vulnerabilities
[Link] Provided by Nmap
Nmap does not directly protect systems like a firewall or antivirus. Instead, it
helps analyze network security and detect vulnerabilities.
Security functions supported by Nmap include:
• Detecting open ports and exposed services
• Identifying outdated or vulnerable software
• Testing firewall rules and configurations
• Monitoring network activity
• Performing network security audits
4. Advantages of Nmap
Nmap provides several benefits for network analysis and security testing.
• Powerful network scanning capabilities.
• Detects open ports and running services quickly
• Supports multiple scanning techniques
• Works on Windows, Linux, and macOS
• Free and open-source tool
• Large community support.
5. Disadvantages of Nmap
Although powerful, Nmap has some limitations.
• Requires knowledge of networking concepts
• May trigger security alerts during scanning
• Scanning large networks may take time
• Risk of misuse if used without permission
6. Practical Demonstration
The following experiment demonstrates how Nmap can be used for network
discovery, port scanning, service detection, and security analysis.
Demonstration of Nmap Scan
1. Starting the Scan
• Command Used: nmap -T4 -A -v [Link]
• Output Line:
• Explanation:
This line indicates that the Nmap scan has started and displays the version of
Nmap being used.
2. Host Discovery (Ping Scan)
• Output Line: Initiating Ping Scan Scanning [Link] Host is up
• Explanation:
Nmap checks whether the target host is active.
The result confirms that the target IP address is reachable on the network.
3. Port Scanning (SYN Stealth Scan)
• Output Line:
Initiating SYN Stealth Scan
Discovered open port 443/tcp
Discovered open port 53/tcp
• Explanation:
Nmap performs a TCP SYN scan on 1000 ports to identify open ports on the
target system.
The scan discovered two open ports:
Port 53 – DNS service
Port 443 – HTTPS secure communication
4. Service Detection
• Output Line:
Initiating Service scan
Scanning 2 services on [Link]
• Explanation:
Nmap attempts to detect which services are running on the discovered open
ports.
5. Traceroute
• Output Line: Initiating Traceroute
•Explanation:
Traceroute identifies the path taken by packets to reach the target host and
shows the number of network hops.
6. Scan Result
• Output Line:
• Explanation:
The scan shows that Port 53 and Port 443 are open.
These ports are used for DNS and secure web communication. The scanned IP
address belongs to the public DNS service provided by Google.
Conclusion:
Nmap is a powerful tool used for network discovery and security auditing. It
helps identify active hosts, open ports, running services, and possible
vulnerabilities in a network. It is widely used by network administrators and
security professionals for monitoring and improving network security.