Scans and sweeps

Malicious programs and rogue processes might investigate a network environment for available ports and hosts using various scanning processes before launching an exploit. Identifying the presence of these reconnaissance processes may allow thwarting the attack before it is launched, as well as tracking down and/or blocking the source of the malicious activity—especially if that source is inside the company as some of them are.

ARP scans

ARP scans, also called as ARP sweeps, are used to discover active localhosts on a network segment. An ARP sweep can be difficult to detect unless you apply a display filter and observe a steady, incremental sweep from the same device, as seen in the following screenshot:

As ARP packets cannot pass through a router, the source device conducting the ARP sweep must be on the same network segment that the ARP packets are seen on.

ICMP ping sweeps

ICMP ping sweeps are used to discover active hosts on local or remote network segments (since ICMP uses IP and is routable) using ICMP Type 8 Echo Requests and Type 0 Echo Replies for a range of IP addresses. You can easily detect ping sweeps by using a display filter icmp.type == 8 || icmp.type == 0.

TCP port scans

TCP port scans allow a malicious agent to discover which TCP ports are open on a target host. Network ports are the entry points to a server or workstation; a service that listens on a given port is able to service requests from a client. Malicious agents can sometimes exploit vulnerabilities in server code to gain access to sensitive data or execute malicious code on the machine, which is why testing all active ports is necessary for a complete coverage of any security validation.

Some of the most common ports used for TCP-based services include:

• 80 HTTP
• 443 HTTPS
• 8080 HTTP proxy
• 8000 HTTP alternate
• 21 FTP
• 22 SSH
• 23 Telnet
• 3389 Microsoft Remote Desktop
• 5900 VNC
• 25 SMTP
• 110 POP3
• 143 IMAP
• 3306 MySQL
• 1433 Microsoft SQL Server
• 1720 H.323
• 5060 SIP

A TCP port scan device will send a TCP SYN packet to a port on a target host, which will respond with either SYN, or ACK if the port is open, or RST if the port is closed. Similar to an ARP scan, a TCP scan can be detected by a series of SYN packets from a single IP address to a target IP address over a range of port numbers. A display filter can make detecting these types of scans easier:

ip.dest == <IP Address of target host> && tcp.flags.syn

UDP port scans

UDP port scans are like TCP scans, but they are run against typical UDP-based services, the most common of which include:

• 53 DNS
• 161/162 SNMP
• 67/68 DHCP
• 5060 SIP
• 135 Microsoft Endpoint Mapper
• 137/139 NetBIOS Name Service

The preceding topics cover just a sampling of the most common scans used by malicious agents. Security analysts should research this topic further to identify all the types of scans that may be used to exploit their particular environment's vulnerabilities.