2008年1月24日 星期四

Ping Sweep

Ping Sweep is to query multiple hosts using ICMP ECHO request. It differs from a single ping in that while as single ping will indicate the availability of one specified host, a ping sweep detects multiple hosts.
There are a number of ping sweep tools for UNIX : gping, nmap; for Windows: Pinger from Rhino9, fping and Ping Sweep from SolarWinds
ICMP does not use ports and hence does not fall under port scanning. Ping sweeps are a small part of network scanning which has to be done before any port scanning.
What is a firewall has blocked ICMP ECHO request? The attacker can still gain information by using ICMP type 13 (TIMESTAMP) and type 17 (Address Mask Requests). Reader interested in learning more can refer to Ofir Arkin's paper on "ICMP Usage in Scanning or Understanding some of the ICMP protocol's Hazards". He also has a tool called Xprobe that use ICMP to scan the network.
WS_Ping ProPack
WS_Ping ProPack implement 32 bit graphic PING client for Windows replacing the old WSPING32. Additional functionalities include: Traceroute, Domain Name Services lookup, Finger, Whois, LDAP, SNMP and SCAN IP.
NetScan Tools
NetScan Tools Pro 2003 has added feature to the standard ping utility such as subnet masking where the tool send an ICMP Address Mask request to the target and reports result. Traceroute and Ping now include graphing capacity which means it show packet verses the response time. The data gathered during a sweepcan be viewed in report form by double clicking on a target. The custom ICMP Generator can generate any ICMP packet type 0-31 including the usual codes.
Hexdump of ping packet can reveal MAC address and IP of the machine. If we can obtain the subnet mask, we can decipher the network address.
hping
hping is a command-line TCP/IP packet assembler/analyzer. It can be downloaded from http://www.hping.org/download.html.
This tool can used for firewall scanning, advanced port scanning, network testing, using different protocol, TOS, fragmentation, man ual path MTU discovery, advanced traceroute, under all the supported protocols, remote OS fingerprinting, remote uptime guessing and TCP/IP stacks auditing.
icmpenum
icampenum not only use ICMP ECHO to probe network, but also ICMP Timestamp, ICMP Information packet as well. It is particular helpful for probing system that failed to block Timestamp or Information packet. It also support trusted addresses.

沒有留言: