nmap

Nmap, the name means Network Mapper, it is a tool, for sanning and analyzing hosts in a network. It is a portscanner, one of the most important tools for an admin, to find open ports. Nmap also allows OS Fingerprinting, so you can collect information about the running OS and its version on a remote host.

You can install nmap with Pakfire or on the shell with the command:

pakfire install -y nmap

Nmap can only be used on the shell, so I want to show you some commands and examples.

The “standard-scan” will scan every port from 1 to 1024 (e.g. on host 192.168.0.1):

nmap 192.168.0.1

If you want to lookup for port 80, because maybe there is a webservice offered:

nmap -p 80 192.168.0.1

To scan a handfull of ports use:

nmap -p 20,21,80 192.168.0.1 

To scan a port range use:

nmap -p 80-90 192.168.0.1

You also can scan more than one host:

nmap -p 80 192.168.0.1,2,3,4 resp. # nmap -p 80 192.168.0.1-4

Settings for ports are the same as above.

As I allready told nmap can be used for OS-gingerprinting, to use this feature you have to add -O to your scan command:

nmap -O 192.168.0.1

As example, the output of a scan from IPfire:

Starting Nmap 4.60 ( http://nmap.org ) at 2008-11-04 17:46 CET
Interesting ports on 192.168.0.1: 
Not shown: 1711 closed ports 
PORT    STATE SERVICE
53/tcp  open  domain
81/tcp  open  hosts2-ns
222/tcp open  rsh-spx
444/tcp open  snpp
MAC Address: 00:XX:XX:XX:XX:XX (Allied Telesyn Internaional)
Device type: testfire
Running: IPCop Linux 2.4.X
OS details: IPCop firewall 1.4.10 - 1.4.15 (Linux 2.4.31 - 2.4.34)
Network Distance: 1 hop 

Nmap is a very powerfull tool and a lot of people have allready written quite good documents how to use it. So I want to refer you to this pages here:

HowTo from Stefano Albrecht

actual list of port numbers

Trojans Port List

Nmap Homepage