Port Scanners

Go through the previous article on TCP/IP before you start over this one. If you are one of those who know networking inside-out, then you can probably skip my advice. If not, I would advise you to do it now as the fundamentals explained them will help you to understand better what I am going to talk henceforth. Today, I want to take up the topic on Port Scanners.

In Internet security, no hacking tool is more celebrated than the scanner. It is said that a good TCP port scanner is worth a thousand user passwords. Before I treat the subject of scanners in depth, I want to familiarize you with scanners. Try not to get inundated by the plethora of information that you can find on scanners. Get the basics right and you'll be well set.

What Is a Scanner?

A scanner is a program that automatically detects security weaknesses in a remote or local host. By deploying a scanner, a user in Los Angeles can uncover security weaknesses on a server in Japan without ever leaving his or her living room.

True scanners are TCP port scanners, which are programs that attack TCP/IP ports and services (Telnet or FTP, for example) and record the response from the target. In this way, they glean valuable information about the target host (for instance, can an anonymous user log in?). Other so-called scanners are merely UNIX network utilities. These are commonly used to discern whether certain services are working correctly on a remote machine. These are not true scanners, but might also be used to collect information about a target host.

A scanner might reveal certain inherent weaknesses within the target host. These might be key factors in implementing an actual compromise of the target's security. In order to reap this benefit, however, you must know how to recognize the hole. Most scanners do not come with extensive manuals or instructions. Interpretation of data is very important.

Limitations of Scanners

A scanner won't tell you the following:

A step-by-step method of breaking in.

The degree to which your scanning activity has been logged.

Basic features of a Scanner

The primary attributes of a scanner is the capability to find a machine or network Once having found a machine, to find out what services are being run on the host. The capability to test those services for known holes This process is not incredibly complex. At its most basic, it involves capturing the messages generated when one tries to connect to a particular service.

Importance of scanners

Scanners are important to Internet security because they reveal weaknesses in the network. Whether this information is used by hackers or crackers is immaterial. If used by system administrators, scanners help strengthen security in the immediate sense. If employed by crackers, scanners also help strengthen security. This is because once a hole has been exploited, that exploitation will ultimately be discovered. Some system administrators argue that scanners work against Internet security when in the hands of crackers. This is not true. If a system administrator fails to adequately secure his or her network (by running a scanner against it), his or her negligence will come to light in the form of a network security breach.

Going through this article, you may feel that scanners are only for UNIX machines. It is not so. But the fact remains that scanners were designed initially for the UNIX machines. And that was because almost 90% of the Internet was run on UNIX machines. Today you can find scanners for any platform, offering unlimited functionality and power. Scanners, unlike sniffers, e-mail bombers, trojans, etc are not illegal. They are viewed upon as tools to improve Internet security rather than breach it.

A good scanner that I'll recommend novices for the Win 32 platform is SuperScan.