Network Scanning Techniques - Understanding how it is done

Aug 26, 2026

Network Scanning Techniques explains how scanning fits into intelligence gathering for computer security, breaking the process into foot printing, scanning, and enumeration. It defines scanning as identifying live, reachable systems and the services they expose, then details how defenders can interpret scan behavior in logs to anticipate unauthorized access attempts. The document emphasizes understanding scanner operation, signatures, and collected information to better prepare and block common scanning methods such as ICMP sweeps and broadcast ICMP.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages17

Reading Time43 min

AccessFree to download

1.0 Introduction

1.1 Introduction to Intelligence Gathering Techniques

1.2 Introduction to scanning

2.0 PING Sweeps

2.1 ICMP sweeps (ICMP ECHO requests)

2.2 Broadcast ICMP

Network Scanning Techniques Understanding how it is done Ofir Arkin [ofir@publicom.co.il](ofir@publicom.co.il) [http://www.publicom.co.il](http://www.publicom.co.il) [http://www.sys-security.com](http://www.sys-security.com) November, 1999 Copyright © Ofir Arkin, 1999 1.0 Introduction 1.1 Introduction to Intelligence Gathering Techniques Imagine the following scenario: A military target is to be attacked. What’s the first step considered?– Gathering Intelligence, naturally. To do so, a satellite will photo the target zone and a special recon unit will patrol the area with maximum caution to eliminate the possibility of detection. After enough information has been gathered, a wing of stealth bombers will bomb the target – Mission accomplished. Gathering intelligence is extremely important. If the amount of data collected is not sufficient, or alternatively, if the target is tightly defended, no attack will be launched. The same is true of computer hacking. An intelligent hacker will conduct a lot of research before attempting to gain privileged access to your systems. If the intelligence gathered shows a poorly defended computer system, an attack will be launched, and unauthorized access will be gained. However, if the target is highly protected, the hacker will think twice before attempting to break in. It will be dependent upon the tools and systems that protect the target. Again, the key here is the amount of information he has gathered beforehand. In the computer hacking world, intelligence gathering can be roughly divided into three major steps: • Foot printing • Scanning • Enumeration Foot Printing-The information collected by the hacker makes a unique footprint or a profile of an organization security posture. With foot printing, using rather simple tools, we gather information such as: 1. Administrative, technical, and billing contacts, which include employee names, email addresses, and phone & fax numbers. 2. IP address range 3. DNS servers 4. Mail servers And we can also identify some of the systems that are directly connected to the Internet. Most of the information here can be freely accessed on the Internet. Scanning-The art of detecting which systems are alive and reachable via the Internet, and what services they offer, using techniques such as ping sweeps , port scans , and operating system identification, is called scanning. The kind of information collected here has to do with the following: 1. TCP/UDP services running on each system identified. 2. System architecture (Sparc, Alpha, x86) . 3. Specific IP addresses of systems reachable via the Internet. 4. Operating system type. Scanning can be compared with a thief checking all the doors and windows of a house he wants to break into. Enumeration-Enumeration is the process of extracting valid accounts or exported resource names from systems. The information is gathered using active connections to systems and queries, which is more intrusive in nature than foot printing and scanning. The techniques are mostly operating system specific, and can gather information such as: 1. User & group names. 2. System banners 3. Routing tables 4. SNMP information This article will focus on scanning, normally the second phase of computer intelligence gathering technique. 1.2 Introduction to scanning Today the number of automated scanners is constantly increasing, and as a result, more and more attacks are successfully initiated. In order to be better prepared, we need to fully understand the scanning tools and the methods that these tools are using against us. The questions we need to ask ourselves are:1 • What are scanners doing? • What do they look like (signature)? • How they operate in order to accomplish their tasks? • What kind of information is collected? • How serious is the threat? We need to identify the intruder’s behavior and understand the scanning techniques. If

FAQs

How do foot printing, scanning, and enumeration differ in intelligence gathering?

Foot printing builds a security posture profile, scanning discovers live reachable systems and exposed services, and enumeration extracts valid accounts or exported resource names using more intrusive queries.

What is the purpose of ICMP sweeps in scanning?

ICMP sweeps determine whether target IP addresses are alive by sending ICMP ECHO requests and checking for ICMP ECHO replies.

How can defenders reduce the risk from ICMP-based scanning?

Blocking ICMP ECHO requests entering the network helps, and scanning attempts can also be identified by recognizing scanning patterns in intrusion detection or log data.

Aug 26, 2026

Upload by Taylor Morgan