6 ms·

In addition to `nmap -h` you might also use `man nmap` for more extensive list of arguments. Take note, doing unwarranted nmap scans is considered network abus

In addition to `nmap -h` you might also use `man nmap` for more extensive list of arguments. Take note, doing unwarranted nmap scans is considered network abuse. Doing it from your VPS might (depending on the hosters TOS) get your contract terminated.

Topgamer7 4y ago
> `nmap -h` you might also use `man nmap` I wish linux man pages had more example sections. TBH I reach for `tldr nmap` or `tldr ...` first in most cases.
- deleted 4y ago
  [deleted]
- justeleblanc 4y ago
  I hadn't heard of tldr. Looks neat! Here's a link for other people who didn't know: https://github.com/tldr-pages/tldr https://github.com/tldr-pages/tldr
  - sublinear 4y ago
    https://tldr.inbrowser.app/ https://tldr.inbrowser.app/
- CyberKimura 4y ago
  Was unaware of this tool, awesome.
- cmdialog 4y ago
  Yeah it's such an old meme to say "Just read the man page" but there are a non-zero amount of completely useless man pages and tldr is a great alternative.
waihtis 4y ago
> Take note, doing unwarranted nmap scans is considered network abuse. Doing it from your VPS might (depending on the hosters TOS) get your contract terminated. For live practice, you should scan IP addresses in countries that are unlikely to be able to prosecute you, like Russia (if you are a westener)* * joking (maybe)
- Keejazz 4y ago
  I would suggest instead, if one really is interested in the topic of networking and port scanning, to set up a lab environment, either virtually, or physically. This is not very costly, unless you need to scan specific enterprise systems that can not be emulated, and are beyond ones price range - to buy to learn. There are also platforms like tryhackme, hackthebox etc., that offer both free and paid networks, on which one can legally scan.
  - waihtis 4y ago
    > This is not very costly, unless you need to scan specific enterprise systems that can not be emulated, and are beyond ones price range - to buy to learn. This is where my advice comes in handy :)
0xdeadbeefbabe 4y ago
> Take note, doing unwarranted nmap scans is considered network abuse. Doing it from your VPS might (depending on the hosters TOS) get your contract terminated. Makes you more excited to read the man page doesn't it?
bheadmaster 4y ago
Interesting note. I wonder where's the cutoff - when exactly does "opening connections" become "abusing the network" - two connections? Two dozen? A thousand? I always assumed network data is network data. I don't see the difference between sending millions of packets of data to stream a video and to scan a network. The only difference is the intention - does that mean the act of learning someone's open ports is what's considered abuse? Or is it consent - the fact that you're learning about open ports that the server owner doesn't want you to know about?
- electroly 4y ago
  The AWS Acceptable Use Policy is at https://aws.amazon.com/aup/ https://aws.amazon.com/aup/ and other providers will have similar. > You may not use, or facilitate or allow others to use, the Services or the AWS Site ... to violate the security, integrity, or availability of any user, network, computer or communications system, software application, or network or computing device; There's no cutoff because it's not about the number of connections; you could conceivably violate this policy with a single connection, and you could be in compliance with a million connections. Note the term "unwarranted" in OP's post.
  - bheadmaster 4y ago
    What exactly defines an "unwarranted" connection? Assume we're not talking about nmap (since it's widely known as a hacker tool which may muddy the waters), but instead of a user-written program that e.g. checks for open ports. If a port is open to the public internet, what exactly makes a connection to it "unwarranted"? As for the AWS rule, scanning open ports does not violate, by itself, any of those things.
    - sjsdaiuasgdia 4y ago
      I have no idea how AWS defines it, but to my mind it's about two things: intent and impact. Intent: What is the connection's purpose? To use a service, to map a topology, to identify potentially vulnerable targets, to consume resources? Impact: How does the act of connecting (once or many times) affect the remote end of the connection? Is a critical resource being exhausted (network connections, cpu, memory, etc)? Is the remote end's service still available for its intended purpose? There's no magic spot on the scales but the further you get away from "to use the service" on the Intent scale and "no detectable impact" on the Impact scale, the more trouble you're likely to run into.
matheusmoreira 4y ago
> doing unwarranted nmap scans is considered network abuse Why?
- zamadatix 4y ago
  You'll often trip security/abuse systems since the traffic looks (and in many cases - is) the same as abusive traffic. If you go and trip those unannounced then there is usually even less sympathy to exclude you than if you ask if they can be bothered to exclude you before you go and start scanning.
  - matheusmoreira 4y ago
    It's just network connections. Why would they make a computer accessible to me if they don't want me connecting to it?
    - zamadatix 4y ago
      There are two "they"s involved in the conversation but generally when using someone else's stuff the more apt question is "why should I have an expectation I can use their stuff however I want without limit". For the "they" of your provider, who is held accountable for allowing abusive traffic, the goal is to provide you outbound connectivity but to do that they also need to ensure they don't get de-peered or their network ranges blocked for hosting abusive traffic. Even for things which don't transit a 4th party there is negative incentive to let your customers abuse each other just because the addresses are reachable. This almost always results in automated systems with limited incentive for good uses of port scanning to be allowed. For the "they" of the end system is (most likely) they didn't make the entire system available to you, just some select services for use in a certain way (e.g. loading their website). Doing that does not provide them an obligation to continuously allow all traffic received at the address to be processed and it's very likely they'll just block you entirely as another layer of defense.
    - addingnumbers 4y ago
      The alerts tend to be geared more toward attempts to reach a secured system that isn't accessible to you.
krylon 4y ago
Years ago, I wrote a primitive portscanner that was deliberately slow to avoid upsetting anyone. It would store hosts and results for scanned ports in a database (it was my toy project for learning SQL) and make sure to only connect to any given host once in a predefined period. Fun times.
teddyh 4y ago
> Take note, doing unwarranted nmap scans is considered network abuse. By whom? I disagree; using nmap is more akin to, say, standing outside a building (on public property) and taking (or painting) a picture of the building. Yes, some people have gotten in trouble for that. Should they, though?
- wongarsu 4y ago
  You could also say it's like going to a large apartment building and ringing all the doorbells to see who's there. And (depending on the nmap flags we're talking about) then profiling their voice on the intercom to figure out what kind of people live in each apartment.
  - teddyh 4y ago
    Perhaps. Ought that be illegal?
    - mcny 4y ago
      > Perhaps. Ought that be illegal? I can't really explain why but I think there is a difference between doing something manually and automating it. For example, it is perfectly ok for a police officer to sit behind the bushes in front of someone's front porch with a pair of binoculars but not ok to put a hidden camera 24/7 in front of everyone's front porch.
      - teddyh 4y ago
        We were (by way of analogy) discussing running nmap manually, I believe.
rikthevik 4y ago
> doing unwarranted nmap scans is considered network abuse After almost being physically ejected from a secure data centre because a member of my group used nmap to see if a port was open, I recommend starting with telnet. :) A wide nmap is probably going to trigger an IDS, and then you get to meet interesting people and answer interesting questions.
- nocsi 4y ago
  There’s something wrong with your org if nmap scans trigger alerts/bring down machines. There’s so many rogue devices scanning networks nowadays that’d I’d be surprised if anyone had port scanning enabled in the filters to minimize false positives.

Topgamer7 4y ago

> `nmap -h` you might also use `man nmap` I wish linux man pages had more example sections. TBH I reach for `tldr nmap` or `tldr ...` first in most cases.

deleted 4y ago
[deleted]
justeleblanc 4y ago
I hadn't heard of tldr. Looks neat! Here's a link for other people who didn't know: https://github.com/tldr-pages/tldr https://github.com/tldr-pages/tldr
- sublinear 4y ago
  https://tldr.inbrowser.app/ https://tldr.inbrowser.app/
CyberKimura 4y ago
Was unaware of this tool, awesome.
cmdialog 4y ago
Yeah it's such an old meme to say "Just read the man page" but there are a non-zero amount of completely useless man pages and tldr is a great alternative.

waihtis 4y ago

> Take note, doing unwarranted nmap scans is considered network abuse. Doing it from your VPS might (depending on the hosters TOS) get your contract terminated. For live practice, you should scan IP addresses in countries that are unlikely to be able to prosecute you, like Russia (if you are a westener)* * joking (maybe)

Keejazz 4y ago
I would suggest instead, if one really is interested in the topic of networking and port scanning, to set up a lab environment, either virtually, or physically. This is not very costly, unless you need to scan specific enterprise systems that can not be emulated, and are beyond ones price range - to buy to learn. There are also platforms like tryhackme, hackthebox etc., that offer both free and paid networks, on which one can legally scan.
- waihtis 4y ago
  > This is not very costly, unless you need to scan specific enterprise systems that can not be emulated, and are beyond ones price range - to buy to learn. This is where my advice comes in handy :)

0xdeadbeefbabe 4y ago

> Take note, doing unwarranted nmap scans is considered network abuse. Doing it from your VPS might (depending on the hosters TOS) get your contract terminated. Makes you more excited to read the man page doesn't it?

bheadmaster 4y ago

Interesting note. I wonder where's the cutoff - when exactly does "opening connections" become "abusing the network" - two connections? Two dozen? A thousand? I always assumed network data is network data. I don't see the difference between sending millions of packets of data to stream a video and to scan a network. The only difference is the intention - does that mean the act of learning someone's open ports is what's considered abuse? Or is it consent - the fact that you're learning about open ports that the server owner doesn't want you to know about?

electroly 4y ago
The AWS Acceptable Use Policy is at https://aws.amazon.com/aup/ https://aws.amazon.com/aup/ and other providers will have similar. > You may not use, or facilitate or allow others to use, the Services or the AWS Site ... to violate the security, integrity, or availability of any user, network, computer or communications system, software application, or network or computing device; There's no cutoff because it's not about the number of connections; you could conceivably violate this policy with a single connection, and you could be in compliance with a million connections. Note the term "unwarranted" in OP's post.
- bheadmaster 4y ago
  What exactly defines an "unwarranted" connection? Assume we're not talking about nmap (since it's widely known as a hacker tool which may muddy the waters), but instead of a user-written program that e.g. checks for open ports. If a port is open to the public internet, what exactly makes a connection to it "unwarranted"? As for the AWS rule, scanning open ports does not violate, by itself, any of those things.
  - sjsdaiuasgdia 4y ago
    I have no idea how AWS defines it, but to my mind it's about two things: intent and impact. Intent: What is the connection's purpose? To use a service, to map a topology, to identify potentially vulnerable targets, to consume resources? Impact: How does the act of connecting (once or many times) affect the remote end of the connection? Is a critical resource being exhausted (network connections, cpu, memory, etc)? Is the remote end's service still available for its intended purpose? There's no magic spot on the scales but the further you get away from "to use the service" on the Intent scale and "no detectable impact" on the Impact scale, the more trouble you're likely to run into.

matheusmoreira 4y ago

> doing unwarranted nmap scans is considered network abuse Why?

zamadatix 4y ago
You'll often trip security/abuse systems since the traffic looks (and in many cases - is) the same as abusive traffic. If you go and trip those unannounced then there is usually even less sympathy to exclude you than if you ask if they can be bothered to exclude you before you go and start scanning.
- matheusmoreira 4y ago
  It's just network connections. Why would they make a computer accessible to me if they don't want me connecting to it?
  - zamadatix 4y ago
    There are two "they"s involved in the conversation but generally when using someone else's stuff the more apt question is "why should I have an expectation I can use their stuff however I want without limit". For the "they" of your provider, who is held accountable for allowing abusive traffic, the goal is to provide you outbound connectivity but to do that they also need to ensure they don't get de-peered or their network ranges blocked for hosting abusive traffic. Even for things which don't transit a 4th party there is negative incentive to let your customers abuse each other just because the addresses are reachable. This almost always results in automated systems with limited incentive for good uses of port scanning to be allowed. For the "they" of the end system is (most likely) they didn't make the entire system available to you, just some select services for use in a certain way (e.g. loading their website). Doing that does not provide them an obligation to continuously allow all traffic received at the address to be processed and it's very likely they'll just block you entirely as another layer of defense.
  - addingnumbers 4y ago
    The alerts tend to be geared more toward attempts to reach a secured system that isn't accessible to you.

krylon 4y ago

Years ago, I wrote a primitive portscanner that was deliberately slow to avoid upsetting anyone. It would store hosts and results for scanned ports in a database (it was my toy project for learning SQL) and make sure to only connect to any given host once in a predefined period. Fun times.

teddyh 4y ago

> Take note, doing unwarranted nmap scans is considered network abuse. By whom? I disagree; using nmap is more akin to, say, standing outside a building (on public property) and taking (or painting) a picture of the building. Yes, some people have gotten in trouble for that. Should they, though?

wongarsu 4y ago
You could also say it's like going to a large apartment building and ringing all the doorbells to see who's there. And (depending on the nmap flags we're talking about) then profiling their voice on the intercom to figure out what kind of people live in each apartment.
- teddyh 4y ago
  Perhaps. Ought that be illegal?
  - mcny 4y ago
    > Perhaps. Ought that be illegal? I can't really explain why but I think there is a difference between doing something manually and automating it. For example, it is perfectly ok for a police officer to sit behind the bushes in front of someone's front porch with a pair of binoculars but not ok to put a hidden camera 24/7 in front of everyone's front porch.
    - teddyh 4y ago
      We were (by way of analogy) discussing running nmap manually, I believe.

rikthevik 4y ago

> doing unwarranted nmap scans is considered network abuse After almost being physically ejected from a secure data centre because a member of my group used nmap to see if a port was open, I recommend starting with telnet. :) A wide nmap is probably going to trigger an IDS, and then you get to meet interesting people and answer interesting questions.

nocsi 4y ago
There’s something wrong with your org if nmap scans trigger alerts/bring down machines. There’s so many rogue devices scanning networks nowadays that’d I’d be surprised if anyone had port scanning enabled in the filters to minimize false positives.