(5) Pings, Port Scans, And Device Fingerprinting

Question 1

What is the ping command?

Answer 1

The ping command is a low level network command that sends an echo request to a remote IP address. It uses Internet Control Message Protocol (ICMP)

Question 2

What do we need to remember about ping commands and the potential echo replies?

Answer 2

If an echo reply doesn’t come back, it doesn’t mean that the remote host isn’t there. Firewalls block ping requests, and individual systems might be set up to ignore echo packets

Question 3

What is hping?

Answer 3

Hping is an advanced version of ping that lets one customized echo request to increase the chance of detection. handcrafted packets can be constructed here as part of a penetration test.

Question 4

What are port scanning tools designed to do?

Answer 4

Port scanning tools are designed to send traffic to remote systems and then get responses that give info about systems and services that they provide.

Question 5

What are the common features of port scanners?

Answer 5

Common features or port scanners include:

-Host discovery
-Port scanning and service identification
-Device fingerprinting
-Service version identification
-Operating system identification

Question 6

What can basic knowledge of how to read a scan is particularly useful?

Answer 6

The basic knowledge that is useful is that scans provide info about hosts on the network, running services, and clues about if they are vulnerable to attack

Question 7

What is operating system fingerprinting?

Answer 7

Operating system fingerprinting is identifying an operating system based on the network traffic that it sends

Question 8

Summarize the basic idea of what operating system fingerprinting does

Answer 8

Operating system fingerprinting is usually done by utilizing TCP/IP stack fingerprinting techniques that focus on comparing responses to TCP and UDP packets sent to remote hosts.

Question 9

What is device fingerprinting?

Answer 9

Device fingerprinting is about the collection and relation of information about a device including details about software, services, and operating system(s) that it runs on that allows for identification

Question 10

What is device fingerprinting particular useful for?

Answer 10

Device fingerprinting is particularly useful for identifying printers and other networked devices but can identify others well too.

Question 11

Can devices still be fingerprinted if they are firewalled?

Answer 11

Devices can still be fingerprinted even if they are firewalled if access to their network traffic and network device logs is possible.