Discovering network hosts with 'TCP SYN' and 'TCP ACK' ping scans in Nmap[Tutorial]

Ping scans are used for detecting live hosts in networks. Nmap's default ping scan (-sP) sends TCP SYN, TCP ACK, and ICMP packets to determine if a host is responding, but if a firewall is blocking these requests, it will be treated as offline. Fortunately, Nmap supports a scanning technique named the TCP SYN ping scan that is very handy to probe different ports in an attempt to determine if a host is online or at least has more permissive filtering rules.

Similar to the TCP SYN ping scan, the TCP ACK ping scan is used to determine if a host is responding. It can be used to detect hosts that block SYN packets or ICMP echo requests, but it will most likely be blocked by modern firewalls that track connection states because it sends bogus TCP ACK packets associated with non-existing connections.

This article is an excerpt taken from the book Nmap: Network Exploration and Security Auditing Cookbook - Second Edition written by Paulino Calderon. In this book, you will be introduced to the most powerful features of Nmap and related tools, common security auditing tasks for local and remote networks, web applications, databases, mail servers and much more.

This post will talk about the TCP SYN and TCP ACK ping scans and its related options.

Discovering network hosts with TCP SYN ping scans

How to do it...

Open your terminal and enter the following command:

# nmap -sn -PS <target>

You should see the list of hosts found in the target range using TCP SYN ping scanning:

# nmap -sn -PS 192.1.1/24 
   Nmap scan report for 192.168.0.1 
   Host is up (0.060s latency). 
   Nmap scan report for 192.168.0.2 
   Host is up (0.0059s latency). 
   Nmap scan report for 192.168.0.3 
   Host is up (0.063s latency). 
   Nmap scan report for 192.168.0.5 
   Host is up (0.062s latency). 
   Nmap scan report for 192.168.0.7 
   Host is up (0.063s latency). 
   Nmap scan report for 192.168.0.22 
   Host is up (0.039s latency). 
   Nmap scan report for 192.168.0.59 
   Host is up (0.00056s latency). 
   Nmap scan report for 192.168.0.60 
   Host is up (0.00014s latency). 
   Nmap done: 256 IP addresses (8 hosts up) scanned in 8.51 seconds

How it works...

The -sn option tells Nmap to skip the port scanning phase and only perform host discovery. The -PS flag tells Nmap to use a TCP SYN ping scan. This type of ping scan works in the following way:

1. Nmap sends a TCP SYN packet to port 80.
2. If the port is closed, the host responds with an RST packet.
3. If the port is open, the host responds with a TCP SYN/ACK packet indicating that a connection can be established.
4. Afterward, an RST packet is sent to reset this connection.

The CIDR /24 in 192.168.1.1/24 is used to indicate that we want to scan all of the 256 IPs in our local network.

There's  more...

TCP SYN ping scans can be very effective to determine if hosts are alive on networks. Although Nmap sends more probes by default, it is configurable. Now it is time to learn more about discovering hosts with TCP SYN ping scans.

Privileged versus unprivileged TCP SYN ping scan

Running a TCP SYN ping scan as an unprivileged user who can't send raw packets makes Nmap use the connect() system call to send the TCP SYN packet. In this case, Nmap distinguishes a SYN/ACK packet when the function returns successfully, and an RST packet when it receives an ECONNREFUSED error message.

Firewalls and traffic filtering

A lot of systems are protected by some kind of traffic filtering, so it is important to always try different ping scanning techniques. In the following example, we will scan a host online that gets marked as offline, but in fact, was just behind some traffic filtering system that did not allow TCP ACK or ICMP requests:

# nmap -sn 0xdeadbeefcafe.com 
   Note: Host seems down. If it is really up, but blocking our ping   
   probes, try -Pn 
   Nmap done: 1 IP address (0 hosts up) scanned in 4.68 seconds 
   # nmap -sn -PS 0xdeadbeefcafe.com 
   Nmap scan report for 0xdeadbeefcafe.com (52.20.139.72) 
   Host is up (0.062s latency). 
   rDNS record for 52.20.139.72: ec2-52-20-139-72.compute-   
   1.amazonaws.com 
   Nmap done: 1 IP address (1 host up) scanned in 0.10 seconds

During a TCP SYN ping scan, Nmap uses the SYN/ACK and RST responses to determine if the host is responding. It is important to note that there are firewalls configured to drop RST packets. In this case, the TCP SYN ping scan will fail unless we send the probes to an open port:

# nmap -sn -PS80 <target>

You can set the port list to be used with -PS (port list or range) as follows:

# nmap -sn -PS80,21,53 <target>
# nmap -sn -PS1-1000 <target>
# nmap -sn -PS80,100-1000 <target>

Discovering hosts with TCP ACK ping scans

How to do it...

Open your terminal and enter the following command:

# nmap -sn -PA <target>

The result is a list of hosts that responded to the TCP ACK packets sent, therefore, online:

# nmap -sn -PA 192.168.0.1/24 
   Nmap scan report for 192.168.0.1 
   Host is up (0.060s latency). 
   Nmap scan report for 192.168.0.60 
   Host is up (0.00014s latency). 
   Nmap done: 256 IP addresses (2 hosts up) scanned in 6.11 seconds

How it works...

The -sn option tells Nmap to skip the port scan phase and only perform host discovery. And the -PA flag tells Nmap to use a TCP ACK ping scan. A TCP ACK ping scan works in the following way:

• Nmap sends an empty TCP packet with the ACK flag set to port 80 (the default port, but an alternate port list can be assigned).
• If the host is offline, it should not respond to this request. Otherwise, it will return an RST packet and will be treated as online. RST packets are sent because the TCP ACK packet sent is not associated with an existing valid connection.

There's more...

TCP ACK ping scans use port 80 by default, but this behavior can be configured. This scanning technique also requires privileges to create raw packets. Now we will learn more about the scan limitations and configuration options.

Privileged versus unprivileged TCP ACK ping scans

TCP ACK ping scans need to run as a privileged user. Otherwise a connect() system call is used to send an empty TCP SYN packet. Hence, TCP ACK ping scans will not use the TCP ACK technique, previously discussed, as an unprivileged user, and it will perform a TCP SYN ping scan instead.

Selecting ports in TCP ACK ping scans

In addition, you can select the ports to be probed using this technique, by listing them after the -PA flag:

# nmap -sn -PA21,22,80 <target>
# nmap -sn -PA80-150 <target>
# nmap -sn -PA22,1000-65535 <target>

Discovering hosts with UDP ping scans

Ping scans are used to determine if a host is responding and can be considered online. UDP ping scans have the advantage of being capable of detecting systems behind firewalls with strict TCP filtering but that left UDP exposed.

This next recipe describes how to perform a UDP ping scan with Nmap and its related options.

How to do it...

Open your terminal and enter the following command:

# nmap -sn -PU <target>

Nmap will determine if the target is reachable using a UDP ping scan:

# nmap -sn -PU scanme.nmap.org 
   Nmap scan report for scanme.nmap.org (45.33.32.156) 
   Host is up (0.13s latency). 
   Other addresses for scanme.nmap.org (not scanned):     
   2600:3c01::f03c:91ff:fe18:bb2f 
   Nmap done: 1 IP address (1 host up) scanned in 7.92 seconds

How it works...

The -sn option tells Nmap to skip the port scan phase but perform host discovery. In combination with the -PU flag, Nmap uses UDP ping scanning. The technique used by a UDP ping scan works as follows:

1. Nmap sends an empty UDP packet to port 40125.
2. If the host is online, it should return an ICMP port unreachable error.
3. If the host is offline, various ICMP error messages could be returned.

There's more...

Services that do not respond to empty UDP packets will generate false positives when probed. These services will simply ignore the UDP packets, and the host will be incorrectly marked as offline. Therefore, it is important that we select ports that are closed for better results.

Selecting ports in UDP ping scans

To specify the ports to be probed, add them after the -PU flag, as follows:

# nmap -sn -PU1337,11111 scanme.nmap.org
# nmap -sn -PU1337 scanme.nmap.org
# nmap -sn -PU1337-1339 scanme.nmap.org

This in this post we saw how network hosts can be discovered using TCP SYN and TCP ACK ping scans. If you've enjoyed reading this post and want to learn how to discover hosts using other ping scans such as ICMP, SCTP INIT, IP protocol, and others head over to our book, Nmap: Network Exploration and Security Auditing Cookbook - Second Edition.

Docker Multi-Host Networking Experiments on Amazon AWS

Hosting the service in IIS using the TCP protocol

FreeRTOS affected by 13 vulnerabilities in its TCP/IP stack