Question

Port scanning allows a user to sequentially probe a number of ports on a target system in order to see if there is a service that is listening. Explain how effective packet filtering can deter scanning probes from devices like FIN scanners.

Answer 1

ANSWER:

• Port Scanning is one of the most popular techniques attackers use to discover services they can break into. All machines connected to a Local Area Network or Internet run many services that listen at well-known and not so well known ports. A port scan helps the attacker find which ports are available. Essentially, a port scan consists of sending a message to each port, one at a time. The kind of response received indicates whether the port is used and can therefore be probed further for weakness.
• Most web servers support proxying so that all web traffic can be directed to a single server for filtering as well as caching to improve performance. A lot of these servers are misconfigured to allow proxying of any request from the Internet, allowing attackers to relay attacks against web sites through a third party
• A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it.
• Packet filtering can deter scanning probes from devices like FIN scanners.FIN packets can bypass firewalls without modification. Closed ports reply to a FIN packet with the appropriate RST packet, whereas open ports ignore the packet on hand. This is typical behavior due to the nature of TCP, and is in some ways an inescapable downfall.

Thank you! plz raise thumbs up.