If you have been following the NMAP articles I have written then you may have noticed something important about the scans. NMAP prefers to perform a Ping. A Ping to NMAP is a test to verify that the system to be scanned is really on-line and exists. If NMAP is to scan multiple systems on a subnet, or a whole subnet, then it will first test which systems are available to scan.
If we use the parameter -P0 or -Pn then we cause NMAP to skip the test for availability. NMAP will assume the systems to scan are on-line. If you need to scan 200 IP Addresses and all of them are off-line and each scan takes 10 seconds then the whole scan can take over 30 minutes!
The ping protocol does not send TCP packets to the remote host to identify open ports. In this article, I’m just using the term “ping the port” in the context of “poking the port” to verify if it’s open (listening) or not. Let’s see three ways to check if a port is open. Checktcp plugin comes by default with nagios-plugins package. This can be used to check tcp connection to any required port. You need to have checkcommand ‘checktcp -p 80′, inside the host template, to monitor the host aliveness with tcpping. I will be starting to document nagios and its configuration in our documentation section, very. Ping is an ICMP protocol, whereas ports are TCP and UDP concepts. All 3 are distinct protocols on top of IP. That means an IP packet containing TCP cannot contain ICMP and vice versa. It also means the TCP header (with the port) is not present in an ICMP ping packet. – MSalters Dec 30 '13 at 13:33.
The problem is that too many Pings on a network can show an administrator that the network is being scanned.
What can you do?
Try a different Ping type available to NMAP.
NOTE: Most of these types are not actual Pings, but they allow NMAP to verify that a system is on-line. If a system is deemed off-line then NMAP will not waste the time to scan the IP Address.
Types of Ping
There are five different types of NMAP Pings to discuss. Two are mainly for use on local networks and the others are useful across subnets including through firewalls.
Be aware of the existence of these methods for NMAP to verify that a system is on. If you are an administrator of a network then you can watch for these specific kinds of network traffic.
The different Ping types are:
- ICMP Echo (TCP/IP Ping)
- ARP Request
- TCP SYN Ping
- TCP ACK Ping
- UDP Ping
- Combination
ICMP Echo Request
On any system with TCP/IP installed there should be a PING utility which uses Internet Control Message Protocol (ICMP) Echo Request to verify if a system is available. The typical Ping command can be given an IP Address or a DNS name to ‘Ping’ another TCP/IP system or device.
The source system will send an ICMP Echo Request. When the target system receives the request it will reply with an ICMP Echo Reply. Once the Reply is received then NMAP knows that the system is available to be scanned.
Usually the ICMP Echo Request will only work on a local subnet since most firewalls will block ICMP messages.
ARP Request
Tcp Ping For Mac Os
The second way that NMAP can detect that a system is on-line is to request the Media Access Control (MAC) Address to see if the system is on-line to be scanned. The MAC Address is a unique ID which is burned into every Network Interface Card (NIC). MAC Addresses are used for sending packets on a local network and not the IP Addresses. IP Addresses are used when going outside the Local Area Network (LAN). For some programs you may enter in an IP Address, but these addresses are converted to a MAC Address. When a system needs to communicate with another system the system name or IP Address is used. Locally, the name or address is used to find the MAC Address through an ARP Request. The MAC Address is then stored in the local ARP Cache. The ARP Cache is a small database which performs a lookup to find the MAC Address for a system. If one is not found then a request is broadcast to all systems on the LAN. If a system receives an ARP Request that matches its system name or IP Address then it will respond with an ARP Reply. The ARP Reply will include the MAC Address. The local system will then add the MAC Address and IP Address to the ARP Cache. To see your ARP Cache, open a Terminal and type the command ‘arp’.
If the system receives an ARP Reply then it shows that the other system is on-line and can be scanned.
It is nothing for an administrator to see ARP Requests on a network. ARP Requests are usually filtered by a Firewall. If you send a request to a remote system the local system will send the packet to the MAC Address of the Gateway. The Gateway will handle the packet from there. If no Ping parameter is specified then the ARP Ping is used by default.
TCP SYN Ping
The SYN and ACK are used in a three-way handshake. They operate similarly in determining if a system is on-line.
With the TCP SYN Ping, the local system will start a three-way handshake with a Target System. The Target System can be on a Local Network or not. The TCP SYN requests can be sent through a Firewall, but they can be blocked.
A request is sent to a system which includes a Port number. The Port Number should be a commonly used Port such as 80. When the Remote System receives the request to open a connection it can produce three consequences.
The first is that the Remote System responds with a SYN/ACK which means it is ready to open a connection. Since a response was received then NMAP knows the system is on-line.
The second possibility is to respond with a Reset (RST) response. The response means that the specified Port is now open for connections. NMAP then knows that the system is on-line since it has responded.
The final possibility is that no response is received. No response could mean that the packet was filtered out by a Firewall. Most likely it means that the system is off-line.
To use the TCP SYN Ping you must have Root privileges and use the parameter ‘-PS’.
TCP ACK Ping
In a three-way handshake the process of opening a line of communications between two systems is as follows:
- The Source System sends a SYN to a Target to start communications
- The Target responds with a SYN/ACK to acknowledge it is okay to proceed with establishing communications
- The Source will either send an ACK to acknowledge setting up communications or a RST to reset and end the communications
To use the TCP ACK Ping you need to have Root privileges and use the paramter ‘-PA’.
UDP Ping
A User Datagram Protocol (UDP) Ping is performed when a Source system sends a UDP datagram to a Target system at a high Port number. Firewalls do not normally block UDP datagrams especially at higher Port numbers. NMAP will default to the Port 31,338.
NMAP is hoping to receive back an ICMP reply that the Port is unreachable for the Target system. NMAP will know that the system is up and running. Since UDP Datagrams are connectionless, meaning there is no guarantee of delivery, then this method can be unreliable. As a last resort it may produce the desired results.
To use the UDP Ping method, include the parameter ‘-PU’ and have Root privileges.
Combination
When performing a default scan of the local subnet NMAP will use an ARP Request to determine if the Target system is on-line. If you go outside of the subnet and use defaults NMAP will perform a TCP ACK and ICMP Echo Request to determine if the Target system is on-line. It is possible that one of the packets may be blocked by a Firewall, but it adds assurance of getting a response from a remote system.
Try these scans out and see how Wireshark shows the ping methods and how the responses are given. Having an understanding of how NMAP determines a system is on-line gives you more knowledge of what is occurring. Happy scanning!
Ping is a networking utility used to test the connection between a local system and its host, measuring the time it takes for packets of data to reach the host, and then return. TCP is a communications protocol part of the internet protocol suite.
This guide will explain what you need to know about both the ping utility and TCP, and how to use ping over a TCP port to check connection. You can learn more about the TCP/IP suite with this networking course, or learn about the other type of communication protocol in this overview of both TCP and UDP.
What is TCP?
Tcp Ping For Mac Pro
TCP stands for transmission control protocol, and is one of the two main communication protocols of the internet. Unlike UDP, or user datagram protocol, TCP is connection-based. It’s used by web browsers to connect to websites over the World Wide Web, and to transfer data from one computer to another.
Instead of breaking data down into smaller packets, which would require multiple IP requests to transfer, an application can make one single request to TCP, and send the data that way. You can learn more about TCP, and other internet protocols like HTTP, in this networking guide.
What is Ping?
Ping is a networking utility that measures latency between two computers connected over a network. In networking, latency is the interval between when a communication is sent, and when a response is received, measuring the round-trip interval between both as a means of determining connectivity.
This is done when the utility sends internet control message protocol (ICMP) packets, or more specifically, “echo requests,” to the host computer or server. A summary containing the results of the ping is printed after the process is complete, a report that contains data about the round-trip time of the connection, and packet loss that might have occurred during the request.
You can learn about this, and more, in this basic computer networking course.
How Do You Ping a TCP port?
There will be times when you might want to manually test a connection over a TCP port using ping. This is very easy to do, as long as you follow the instructions below.
- TCP ping help on Windows
If you’re using Microsoft Windows, the first thing you want to do is open the command prompt. If you’re on a newer operating system, you can do this by opening the Run prompt, typing in cmd.exe, and pressing Enter. Or, if your Start menu has a search bar, just type in cmd and press Enter.
Once the command prompt is open, you’ll see something like this:
From here, type in the word “ping” without the quotes, followed by a space, followed by the IP address or website you want to test the connection between. For instance, let’s say we want to ping Google.com. We’d type in:
Press Enter, and it will return the following report:
In this report, 74.125.239.134 is the IP address of the server that Google.com is hosted on. The report shows that four packets were sent, four packets were received, zero packets were lost, and that the average round-trip time in milliseconds was 17. If the echo request was unsuccessful and the ping failed, we would see a message reading “request timed out.”
You can learn about internet protocol and more in this course on IP addressing and subnetting.
- TCP ping help on Mac
Using the ping utility on Mac is much simpler with the Network Utility application. Just open Network Utility and select the Ping tab. You’ll see a text field where you can enter in the IP or website address you want to ping, and the option to send an unlimited amount of pings, or a number of your choice.
Below that is where the result of the ping will be displayed. Once you’re ready to ping your chosen network address, just press the aptly labeled Ping button and watch the results of your request print below.
Want to be a network engineer? Learn more about TCP/IP, ping, and other networking concepts in this course.