A review of port scanning techniques

Abstract

This paper reports the most important techniques used by TCP port scanners . TCP port scanners are specialized programs used to determine what TCP ports of a host have processes listening on them for possible connections. Since these ports characterize, in part, the amount of exposure of the hosts to potential external attacks, knowing their existence is a fundamental matter for network and/or security administrators. Moreover, as scanners are also used by hackers, administrators need to know how they work and what possible weakness they exploit to be able to prevent unwanted scanning or at least to record each scanning attempt.

ADRISYA: A Flow Based Anomaly Detection System for Slow and Fast Scan

“…Since data transfer can be possible only through the established connection, for any successful TCP communication need to have more than three packets. But in the scanning time, an attacker's intention is only to verify status of the port, and therefore most of the connection will terminate before the completion of three way handshake process [17]. Moreover, if three-way handshake does not happen, connection details cannot be identified by log analysis.…”

How can sliding HyperLogLog and EWMA detect port scan attacks in IP traffic?

“…Thus, the server becomes unreachable by legitimate users, causing a significant financial loss in some cases. Port scan is a particular DoS attack that aims to discover available services on the targeted system [1]. It essentially consists of sending an IP packet to each port and analyzing the response to the connection attempts.…”

An Innovative UDP Port Scanning Technique

“…UDP scanners typically send some empty UDP datagrams [9] to the UDP ports of SUT and decide the port status based on the UDP packet response. Nmap and Nessus [10] send application specific UDP probes to increase the efficiency in discovering the state of UDP packet.…”