Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-)

Port Scanning Papers

• [PDF] Know Your Network chapter from O'Reilly book
• SANS Intrusion Detection FAQ How can passive techniques be used to audit and discover network vulnerability
• Scan of the month challange Members from the South Florida Honeynet team manually generated five different types of portscans from the Internet to a single honeypot. These are not portscans captured from the wild. The term "the wild" is used to describe any host we don't know about outside of our network. In other words, any host other than our own connected to the Internet involved in reconnaissance, an intrusion, and/or system compromise is a system in the wild. During each scan, our network intrusion detection sensor captured each scan and saved it to a binary log file. We used snort to capture each scan in tcpdump format. It's important to note that tcpdump and snort use the libpcap library to capture and store packets from off the wire. So you can learn more about the packet capture technologies used to capture the portscans during this challenge, we have provided links to help get you on the right foot. It is up to you-the beginner analyst-to pull the binary file into a packet decoder such as tcpd u! mp, or ethereal to analyze each scan. Your mission, if you choose to accept it is to answer the questions below the best that you can.
• Network Scanning Techniques -- decent
• Plugging Security Holes -- paper
• Holy Intruders! IP-Based Security Auditing Tools
• Improving the Security of Your Site by Breaking Into It
• SATAN- Security Administrator's Tool for Analyzing Networks
• scan21_SCAN 21 - June 2002 by Raul Siles (Spain).
• Network_magazine/System Fingerprinting System Fingerprinting With Nmap by Rick Farrow (2000).
• Windows Messenger in Windows XP: Working with Firewalls and Network Address Translation Devices
•  Windows NT, Terminal Server, and Microsoft Exchange Services Use TCP/IP Ports  a good list from Microsoft
•  "Well Known" TCP and UDP Ports Used By Apple Software Products  Apple's list
• Cisco PIX Firewall and Stateful Firewall Security this white paper contains some useful information about the ports and connection protocols for VDOnet, CU-SeeMe, and RealAudio. See also Intel document The Problems and Pitfalls of Getting H.323 Safely Through Firewalls. Note in particular that RTCP (Real Time Control Protocol) has no fixed port, an RTCP session is paired with an RTP session, if you have an RTP stream on even numbered UDP port x, RTCP is on x + 1.
• Block those ports! useful information about dangerous ports He also links to my page from the about.com Windows and Internet Security Information page on
• TCP and UDP ports. About.com
• Blocking Chat Programs.
• resources for home network users
  • PracticallyNetworked:
    • Handling Special Applications
    • Special Applications - Opening Ports
    • Special Applications - Port List
  • HomeNetHelp:
    • Explaining DMZs and Port Forwarding
    • Port list for running a server through a router
    • Port list for running a game server through a router or firewall

Last modified: February 28, 2008