4 ms·
Port scanning is a brute force, over-reaching probing technique. A better analogy would be like visiting a shopping mall and trying to open every closed door yo
by sedatk 6y ago
Port scanning is a brute force, over-reaching probing technique. A better analogy would be like visiting a shopping mall and trying to open every closed door you see, including the ones that say "authorized personnel only", "private", "do not enter" with an excuse like "I was trying to find out which shop was open".
- jolmg 6y agoI answered an almost identical reply, here[1]. > including the ones that say "authorized personnel only", "private", "do not enter" Basically, to answer you separately, an analogy like that doesn't represent TCP accurately. In your analogy, you can 1) see from afar for visual cues indicating whether access is being given to you, and 2) try opening it. Your argument is that doing 2 is invasive, because they can do 1. However, in TCP, you can only try to make the connection. There is no see from afar. If I give you an IP address, there's no standard way for you to tell me whether FTP is available, without trying to connect to the port! That's your only choice! So, yes, "I was trying to find out which [service is available]" is a very valid reason. > Port scanning is a brute force, over-reaching probing technique. It certainly is brute-force, and that sucks. I think there's a network service / protocol called Portmapper/rpcbind[2] that lists the services available and port numbers they're on. I only know that NFS uses it, but nothing else. If that were standard, then I'd agree port scanning is over-reaching. As it stands, though, I don't consider it over-reaching when it's the only TCP mechanism to see what's available online. [1] https://news.ycombinator.com/item?id=23249246 https://news.ycombinator.com/item?id=23249246 [2] https://en.wikipedia.org/wiki/Portmap https://en.wikipedia.org/wiki/Portmap
- sedatk 6y agoNope. Ports that you can use are already advertised to you: web links, MX records, registrar records, WSDLs etc. Enumerating all ports that aren’t advertised to you is an overreach.
- cwkoss 6y ago> including the ones that say "authorized personnel only", "private", "do not enter" with an excuse like "I was trying to find out which shop was open". I don't think this part of the analogy is accurate. There are no "authorized personnel only" ports The first half of the analogy is good though.
- sedatk 6y agoAny port that isn’t advertised to you explicitly is an overreach. You don’t run through hosts and ports to “find out services to use”. What’s a legitimate use case for that other than peeping?
- m463 6y agoI used to think the exact same thing about wardriving. Nobody should catalog wifi access points and their location! Of course, now this ethical lapse is a business model and apple, google and everyone else does it. literally anyone with a smartphone is doing this to your wifi access point. And they will do the reverse to find out precise location.
- sedatk 6y agoExactly. There are assumptions in every threat model, and violating them isn't a legitimate use case because someone "forgot to protect" their private resource. "Door wasn't locked" isn't an excuse.
- thejynxed 6y agoOr in the case of being a Comcast customer, you get no say in the matter as they force an open guest network if you use their equipment.
- ghostpepper 6y agoIn a store you can read the sign. Where is the sign saying that the port is not for you?
- sedatk 6y agoAny port that is not advertised to you isn’t okay to probe.
- tripzilch 6y agoBut when I'm visiting a website, I am not a "store". These ports are on localhost, that's more like asking where is the sign saying that my bedroom door is not for you to try and open. However, I will tell you behind which door the bathroom is.