Computer Science Cybersecurity Nmap and Network Scanning
Nmap and Network Scanning
Nmap and network scanning represent a foundational aspect of cybersecurity reconnaissance, involving the process of actively probing a computer network to discover hosts, identify open ports, and enumerate the services and operating systems running on them. Nmap (Network Mapper) is the industry-standard, open-source tool used to perform these scans, offering a powerful and versatile set of techniques for mapping network topologies and gathering intelligence. This information is invaluable for both network administrators conducting security audits and penetration testers identifying vulnerabilities, as well as for malicious attackers who use it as a preliminary step to find potential targets and plan their attacks.
1.1.
The OSI Model
1.1.1.
Overview and Purpose of the OSI Model
1.1.2.
Layer 1: Physical
1.1.2.1. Physical Media Types
1.1.2.1.2. Fiber Optic Cables
1.1.2.2. Network Topologies
1.1.2.3. Signal Transmission Methods
1.1.2.3.1. Electrical Signals
1.1.2.3.2. Optical Signals
1.1.2.3.3. Radio Frequency Signals
1.1.3.
Layer 2: Data Link
1.1.3.1.1. MAC Address Structure
1.1.3.1.2. Unicast vs Multicast vs Broadcast
1.1.3.2.1. Frame Structure
1.1.3.3. Switches and Bridges
1.1.3.3.1. Learning and Forwarding
1.1.3.3.2. Spanning Tree Protocol
1.1.3.4. Error Detection and Correction
1.1.3.4.2. Frame Check Sequence
1.1.4.
Layer 3: Network
1.1.4.1.1. IPv4 Address Structure
1.1.4.1.2. IPv6 Address Structure
1.1.4.2.2. Dynamic Routing
1.1.4.2.3. Default Gateway
1.1.4.3. Routers and Layer 3 Devices
1.1.4.3.1. Router Functions
1.1.4.3.2. Layer 3 Switches
1.1.4.4. Subnetting and Supernetting
1.1.4.4.3. Route Summarization
1.1.5.
Layer 4: Transport
1.1.5.1.1. Connection-Oriented vs Connectionless
1.1.5.1.2. Reliability Mechanisms
1.1.5.2. Ports and Sockets
1.1.5.2.1. Port Number Ranges
1.1.5.3. Flow Control and Congestion Control
1.1.5.3.1. TCP Window Size
1.1.5.3.2. Congestion Avoidance
1.1.6.
Layer 5: Session
1.1.6.1. Session Establishment and Termination
1.1.6.2. Session Management Protocols
1.1.7.
Layer 6: Presentation
1.1.7.1. Data Encoding and Encryption
1.1.7.1.1. Character Encoding
1.1.7.2.1. Lossless Compression
1.1.7.2.2. Lossy Compression
1.1.8.
Layer 7: Application
1.1.8.1. Application Protocols
1.1.8.2. Client-Server Model
1.1.8.2.1. Request-Response Pattern
1.1.8.2.2. Stateful vs Stateless
1.2.
The TCP/IP Model
1.2.1.
Comparison with OSI Model
1.2.1.2. Practical Implementation
1.2.2.
Network Interface Layer
1.2.2.1. Ethernet and Wi-Fi
1.2.2.1.1. Ethernet Standards
1.2.2.1.2. Wi-Fi Standards
1.2.2.2.1. ARP Request and Reply
1.2.3.
Internet Layer
1.2.3.1.1. IPv4 Addressing
1.2.3.1.2. IPv6 Addressing
1.2.3.2. Routing Protocols
1.2.3.3.1. Error Reporting
1.2.3.3.2. Diagnostic Functions
1.2.4.
Transport Layer
1.2.4.1.1. Reliable Delivery
1.2.4.1.2. Sequence Numbers
1.2.4.1.3. Acknowledgments
1.2.4.2.1. Unreliable Delivery
1.2.4.2.2. Minimal Overhead
1.2.4.3.1. Well-Known Ports
1.2.4.3.2. Registered Ports
1.2.5.
Application Layer
1.2.5.1. Common Application Protocols
1.2.5.1.2. Email Protocols
1.2.5.1.3. File Transfer Protocols
1.2.5.2. DNS and Name Resolution
1.2.5.2.2. DNS Record Types
1.2.5.2.3. Name Resolution Process
1.3.
Core Protocols
1.3.1.
Internet Protocol (IP)
1.3.1.1. IPv4 Addressing and Subnetting
1.3.1.1.1. Address Classes
1.3.1.1.2.1. Default Subnet Masks
1.3.1.1.2.2. Custom Subnet Masks
1.3.1.1.3.1. Prefix Length
1.3.1.1.3.2. Network and Host Portions
1.3.1.1.4. Private vs Public Addresses
1.3.1.1.4.1. RFC 1918 Private Ranges
1.3.1.2.1. Address Structure
1.3.1.2.1.1. 128-bit Address Space
1.3.1.2.1.2. Hexadecimal Notation
1.3.1.2.2. Prefixes and Notation
1.3.1.2.2.1. Global Unicast
1.3.1.2.3. Transition Mechanisms
1.3.2.
Transmission Control Protocol (TCP)
1.3.2.1. The Three-Way Handshake
1.3.2.1.4. Initial Sequence Numbers
1.3.2.3. Connection Termination
1.3.2.3.1. Four-Way Handshake
1.3.2.3.2. FIN-ACK Sequence
1.3.2.3.3. TIME_WAIT State
1.3.2.3.4. Connection Reset
1.3.2.4. TCP State Machine
1.3.3.
User Datagram Protocol (UDP)
1.3.3.1. Connectionless Communication
1.3.3.1.1. No Connection Setup
1.3.3.1.2. No Connection State
1.3.3.2. UDP Header Structure
1.3.3.2.2. Destination Port
1.3.3.3. Use Cases and Limitations
1.3.3.3.1. Real-Time Applications
1.3.3.3.4. Streaming Media
1.3.4.
Internet Control Message Protocol (ICMP)
1.3.4.1. Echo Request and Reply
1.3.4.1.1. Ping Functionality
1.3.4.1.2. Payload Structure
1.3.4.2. Destination Unreachable Messages
1.3.4.2.1. Network Unreachable
1.3.4.2.2. Host Unreachable
1.3.4.2.3. Port Unreachable
1.3.4.2.4. Protocol Unreachable
1.3.4.3. Time Exceeded Messages
1.3.4.3.2. Fragment Reassembly Timeout
1.3.4.4. Redirect Messages
1.3.4.4.2. Network Redirect
1.3.4.5. Parameter Problem Messages
1.3.4.6. Source Quench Messages
1.4.
Ports and Services
1.4.1.
Well-Known Ports (0-1023)
1.4.2.
Registered Ports (1024-49151)
1.4.2.1. Application-Specific Services
1.4.2.2. Vendor-Specific Ports
1.4.2.3.2. PostgreSQL (5432)
1.4.3.
Dynamic/Private Ports (49152-65535)
1.4.3.2. Client-Side Connections
1.4.3.3. Operating System Allocation
1.4.4.
Port States
1.4.4.1.1. Service Listening
1.4.4.1.2. Accepting Connections
1.4.4.2.1. No Service Listening
1.4.4.2.2. Port Accessible
1.4.4.3.1. Firewall Blocking
1.4.4.3.2. No Response Received
1.4.4.4.1. Port Accessible
1.4.4.4.2. State Undetermined
1.4.4.5.1. Ambiguous Response
1.4.4.5.2. UDP Scan Results
1.4.4.6.1. ICMP Unreachable
1.4.4.6.2. Filtered Response
1.4.5.
Port Scanning Concepts
1.4.5.1.1. Connection-Based vs Connectionless
1.4.5.1.2. Response Patterns
1.4.5.2. Service Identification
1.4.5.2.1. Banner Grabbing
1.4.5.2.2. Service Fingerprinting
1.4.5.2.3. Version Detection