官术网_书友最值得收藏!

Discovering hosts with ICMP ping scans

Ping scans are used to determine if a host is online and responding. ICMP messages are used for this purpose, and hence ICMP ping scans use these types of packets to accomplish this.

The following recipe describes how to perform an ICMP ping scan with Nmap, and the flags for the different types of ICMP messages.

How to do it...

To make an ICMP echo request, open your terminal and enter the following command:

# nmap -sP -PE scanme.nmap.org

If the host responded, you should see something similar to this:

# nmap -sP -PE scanme.nmap.org 


Nmap scan report for scanme.nmap.org (74.207.244.221) 
Host is up (0.089s latency). 
Nmap done: 1 IP address (1 host up) scanned in 13.25 seconds 

How it works...

The arguments -sP -PE scanme.nmap.org tell Nmap to send an ICMP echo request packet to the host scanme.nmap.org. We can determine that a host is online if we receive an ICMP echo reply to this probe.

SENT (0.0775s) ICMP 192.168.1.102 > 74.207.244.221 Echo request (type=8/code=0) ttl=56 id=58419 iplen=28 
RCVD (0.1671s) ICMP 74.207.244.221 > 192.168.1.102 Echo reply (type=0/code=0) ttl=53 id=24879 iplen=28 
Nmap scan report for scanme.nmap.org (74.207.244.221) 
Host is up (0.090s latency). 
Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds 

There's more...

Unfortunately, ICMP has been around for a pretty long time, and remote ICMP packets are now usually blocked by system administrators. However, it is still a useful ping technique for monitoring local networks.

ICMP types

There are other ICMP messages that can be used for host discovery, and Nmap supports the ICMP timestamp reply (-PP) and address mark reply (-PM). These variants could bypass misconfigured firewalls, which only block ICMP echo requests.

$ nmap -sP -PP <target>
$ nmap -sP -PM <target>

See also

  • The Finding live hosts in your network recipe in Chapter 1, Nmap Fundamentals
  • The Discovering hosts with TCP SYN ping scans recipe
  • The Discovering hosts with TCP ACK ping scans recipe
  • The Discovering hosts with UDP ping scans recipe
  • The Discovering hosts with IP protocol ping scans recipe
  • The Discovering hosts with ARP ping scans recipe
  • The Discovering hosts using broadcast pings recipe
  • The Discovering stateful firewalls by using a TCP ACK scan recipe in Chapter 3, Gathering Additional Host Information
主站蜘蛛池模板: 平塘县| 从化市| 越西县| 蓝山县| 绿春县| 循化| 武汉市| 桑日县| 云林县| 清徐县| 中西区| 罗城| 安福县| 河源市| 龙南县| 连江县| 梅河口市| 明溪县| 武义县| 乾安县| 西盟| 崇州市| 山东省| 桦南县| 高阳县| 永登县| 含山县| 西宁市| 荆门市| 深州市| 扶余县| 营口市| 芒康县| 宁德市| 崇州市| 峨山| 钟祥市| 彝良县| 将乐县| 永平县| 山东省|