Nmap in the enterprise your guide to network scanning - Orebaugh, Angela; Pinkard, Becky (Burlington, MA : Syngress Pub., 2008)
Nmap, or Network Mapper, is a free, open source tool that is available under the GNU General Public License as published by the Free Software Foundation. It is most often used by network administrators and IT security professionals to scan corporate networks, looking for live hosts, specific services, or specific operating systems. Part of the beauty of Nmap is its ability to create IP packets from scratch and send them out utilizing unique methodologies to perform the above-mentioned types of scans and more. This book provides comprehensive coverage of all Nmap features, including detailed, real-world case studies. Understand Network Scanning Master networking and protocol fundamentals, network scanning techniques, common network scanning tools, along with network scanning and policies. Get Inside Nmap Use Nmap in the enterprise, secure Nmap, optimize Nmap, and master advanced Nmap scanning techniques. Install, Configure, and Optimize Nmap Deploy Nmap on Windows, Linux, Mac OS X, and install from source. Take Control of Nmap with the Zenmap GUI Run Zenmap, manage Zenmap scans, build commands with the Zenmap command wizard, manage Zenmap profiles, and manage Zenmap results. Run Nmap in the Enterprise Start Nmap scanning, discover hosts, port scan, detecting operating systems, and detect service and application versions Raise those Fingerprints Understand the mechanics of Nmap OS fingerprinting, Nmap OS fingerprint scan as an administrative tool, and detect and evade the OS fingerprint scan. Tool around with Nmap Learn about Nmap add-on and helper tools: NDiff--Nmap diff, RNmap--Remote Nmap, Bilbo, Nmap-parser. Analyze Real-World Nmap Scans Follow along with the authors to analyze real-world Nmap scans. Master Advanced Nmap Scanning Techniques Torque Nmap for TCP scan flags customization, packet fragmentation, IP and MAC address spoofing, adding decoy scan source IP addresses, add random data to sent packets, manipulate time-to-live fields, and send packets with bogus TCP or UDP checksums.
Chapter 1: Introducing Network Scanning. This chapter will cover the fundamentals of network scanning and how it works and why it is used. It will also include the necessary TCP/IP and networking background for a beginning user. -- Chapter 2: Introducing Nmap. This chapter will provide an overview of the nmap tool including the main features, basic functionality, history, and other resources. This chapter will also cover the uses of nmap such as security auditing, policy compliance testing, network inventory, and asset management. -- Chapter 3: Using Nmap. This chapter will cover downloading and installing nmap and cover its basic usage including command line options for scanning techniques, ping options, OS fingerprinting, logging, and other options. It should also include a section on Windows only options. -- Chapter 4: Fingerprinting with Nmap. This chapter will cover the fundamentals of operating system fingerprinting and version detection. It will provide details on how nmap performs fingerprinting. This chapter will also include related tools such as IP Personality and Morph that are used to defeat nmap fingerprinting. -- Chapter 5: Detection and Evasion with Nmap. This chapter will provide an overview of the methods used to detect nmap scans, such as Snort signatures. It will also cover Nmap evasion techniques that are used to evade detection. -- Chapter 6: Scanning in the Real World. This chapter will provide several examples of nmap scanning and the results of the scan. It will be written so the user can follow along as if he/she is performing the scan, thus mimicking a real life scenario or lab work. A good example to include would be using nmap to audit a firewall. -- Chapter 7: Tooling Around with Nmap. This chapter will cover a variety of tools that either use nmap or work with nmap to perform various network and security-related functionality. Tools may include Remote nmap (Rnmap), Bilbo, NDiff, nlog, Sawmill, and Nmap-Parser.
Includes index.
Keywords: Computer networks -- Monitoring -- Computer programs; Computer networks -- Security measures -- Computer programs; Electronic books