How Does Port Scanning Work

The video tutorial covers the basics of port scanning, focusing on TCP and UDP methods. It explains the Connect and SYN scan techniques for TCP, highlighting the three-way handshake and stealth aspects. UDP scanning is discussed, noting its stateless nature and potential unreliability due to ICMP packet handling by firewalls. The tutorial introduces the Nmap tool, emphasizing its capabilities and the importance of considering traffic implications during scans.

What is the main difference between the Connect and SYN/Stealth methods of TCP port scanning?

• SYN/Stealth is faster than Connect.

• Connect completes the three-way handshake, while SYN/Stealth does not.

• Connect is more secure than SYN/Stealth.

• SYN/Stealth is used only for UDP ports.

Why is UDP scanning considered unreliable?

• Because UDP scanning is not supported by most tools.

• Because UDP is slower than TCP.

• Because UDP requires a three-way handshake.

• Because firewalls may drop ICMP packets, leading to misleading results.

What is a key feature of the Nmap tool?

• It does not generate any network traffic.

• It is capable of scanning both TCP and UDP ports.

• It can scan up to 100 ports at a time.

• It only scans TCP ports.

How much traffic is generated by scanning all 65,535 ports on a machine using Nmap?

• 1 gigabyte

• 270 kilobytes

• 4 megabytes

• 10 megabytes

What should be considered when using Nmap to scan a full subnet?

• The speed of the network.

• The amount of traffic generated.

• The number of open ports.

• The type of firewall used.