Port Scan Protocol Matching: Why It Matters

TL;DR

Yes! Matching your scan protocol to the service running on a port dramatically improves accuracy and reduces false positives. Using the wrong protocol can miss vulnerabilities, give misleading results, or even crash services. This guide explains why and how.

Why Protocol Matching is Important in Port Scanning

When you scan a port, you’re essentially trying to talk to whatever service is listening there. Different services ‘speak’ different languages (protocols). If you try to speak the wrong language, you won’t get a useful response.

• Accuracy: Some protocols are designed for specific tasks. A scan expecting HTTP on port 80 will fail if it finds an SMTP server there.
• False Positives/Negatives: Incorrect protocol selection can lead to believing a port is open when it isn’t, or missing vulnerabilities that exist.
• Service Disruption: Sending the wrong data can sometimes crash poorly written services.

Step-by-Step Guide to Protocol Matching

1. 1. Identify Services Running on Ports: Before scanning, find out what’s *supposed* to be running on each port you’re interested in. Common ports have standard services (e.g., 80 = HTTP, 22 = SSH). However, things can be configured differently.
   • Nmap: Use Nmap with service detection (-sV) for a quick overview:

     nmap -sV target_ip

   • Netstat/ss (Linux): These commands show listening ports and associated processes.

     netstat -tulnp | grep LISTEN

     ss -tulnp | grep LISTEN

2. 2. Choose the Correct Scan Type: Nmap offers various scan types, each using a different protocol.
   • TCP Connect Scan (-sT): Establishes a full TCP connection. Good for basic connectivity checks but easily detectable.
   • SYN Scan (-sS): ‘Half-open’ scan; faster and stealthier than -sT, requires root privileges.
   • UDP Scan (-sU): Scans UDP ports. Often slower and less reliable due to the connectionless nature of UDP.
   • Specific Protocol Scans: Nmap can scan for specific protocols like HTTP, FTP, SMTP etc. using script scanning (-sV) or dedicated scripts.

     nmap -p 80 --script http-title target_ip

3. 3. Verify Scan Results: Don’t blindly trust scan results! Manually verify findings using tools like `telnet` or dedicated protocol analysers (Wireshark).
   • Telnet Example (HTTP):

     telnet target_ip 80

     If you get a connection and see HTTP banner information, it confirms the service.

4. 4. Script Scanning for Detailed Protocol Analysis: Nmap’s scripting engine (NSE) provides powerful scripts to identify vulnerabilities specific to certain protocols.
   • Example: HTTP Vulnerability Scan:

     nmap -p 80 --script vuln target_ip

5. 5. Consider Firewall/IDS Rules: Firewalls and intrusion detection systems (IDS) can block or alter scan traffic. This might affect your results.
   • Fragmentation: Some firewalls detect fragmented packets. Use Nmap’s fragmentation options (-f) to bypass these rules, but be cautious as this can also increase noise.

     nmap -sS -f target_ip

Common Protocol/Port Combinations

• 21: FTP (TCP) – Use TCP scans, consider FTP vulnerability scripts.
• 22: SSH (TCP) – Use TCP scans; check for weak ciphers or key exchange algorithms.
• 23: Telnet (TCP) – Avoid if possible due to security risks; use TCP scans if necessary.
• 25: SMTP (TCP) – Use TCP scans, look for open relay vulnerabilities.
• 53: DNS (UDP/TCP) – Scan both UDP and TCP ports; check for zone transfers or other DNS misconfigurations.
• 80: HTTP (TCP) – Use TCP scans, focus on web application vulnerability scanning.
• 110: POP3 (TCP) – Use TCP scans; look for password sniffing vulnerabilities.
• 443: HTTPS (TCP) – Use TCP scans, verify SSL/TLS configuration and certificate validity.