[SOLVED] is there a good way to run nmap scans over the public net?

psycroptic · 04-12-2014, 01:17 AM

i've heard it's no bueno to do this...

berndbausch · 04-12-2014, 03:15 AM

The net itself doesn't matter or mind, but when you check the ports of a host that you don't own, it can be interpreted as searching for a way to break in.

psycroptic · 04-12-2014, 12:04 PM

should have clarified, most definitely to one of my own hosts

turnbui · 05-04-2014, 01:44 PM

Interesting one. Surely as this is his/her own telephone line there shouldn't be any other traffic but his/hers and his/hers ISPs. Or am I missing something basic?

psycroptic · 05-04-2014, 02:18 PM

Quote:

Originally Posted by turnbui

Interesting one. Surely as this is his/her own telephone line there shouldn't be any other traffic but his/hers and his/hers ISPs. Or am I missing something basic?

it's actually Comcast cable as my ISP on both ends, and yes, theoretically traffic to/from 2 endpoints on the same ISP SHOULD never cross other providers lines, provided the 2 endpoints are geographically close to each other. Going cross-country, i could see you potentially getting routed across peered links of some sort.

But even on the same ISP, i had figured that port scans could potentially violate some sort of terms-of-service, because as berndbausch said, it can be seen as a security circumvention attempt. A cursory glance at Comcasts TOS don't explicity show anything of the sort, but it wouldn't surprise me to find that they'd rather you not do this.

turnbui · 05-04-2014, 06:25 PM

Yes I can appreciate the security concern.

http://serverfault.com/questions/582...ients-from-isp

unSpawn · 05-04-2014, 06:45 PM

Quote:

Originally Posted by psycroptic

should have clarified, most definitely to one of my own hosts

Apart from TOS etc kind of depends what you can do. Is it to be a targeted scan? Nmap has speed settings. If you target your own machine with specific ports, say "-p21,22,23,25,80,443,993,10000", no excessive retries and try "-T1"? Or a general vulnerability assessment? You know there's sites that can do that for you for free, only requiring registration (added bonus of having a 3rd party to "blame" ;-p)?

psycroptic · 05-04-2014, 08:22 PM

Quote:

Originally Posted by unSpawn

Apart from TOS etc kind of depends what you can do. Is it to be a targeted scan? Nmap has speed settings. If you target your own machine with specific ports, say "-p21,22,23,25,80,443,993,10000", no excessive retries and try "-T1"? Or a general vulnerability assessment? You know there's sites that can do that for you for free, only requiring registration (added bonus of having a 3rd party to "blame" ;-p)?

Lol! no i was just gonna do a range of 1-1024 on my own firewall, from my parents house. rather not have to register for yet another site. both locations have comcast.

unSpawn · 05-05-2014, 01:13 AM

Quote:

Originally Posted by psycroptic

i was just gonna do a range of 1-1024 on my own firewall

Post output of 'iptables-save'?

psycroptic · 05-05-2014, 01:18 AM

Quote:

Originally Posted by unSpawn

Post output of 'iptables-save'?

why?

unSpawn · 05-05-2014, 12:47 PM

Quote:

Originally Posted by psycroptic

why?

Because we see in one glance if it's worth doing so?

psycroptic · 05-05-2014, 01:36 PM

Code:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -p icmp --icmp-type echo-request -m limit --limit 3/s --limit-burst 1 -j ACCEPT
-A INPUT -p icmp --icmp-type echo-request -j DROP
-A INPUT -p icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp --icmp-type 11 -j ACCEPT

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT

COMMIT

though we're straying from the topic somewhat, marking as solved

unSpawn · 05-05-2014, 01:43 PM

You have a default filter table INPUT chain DROP policy and you only allow ingress traffic (any protocol) for existing connections so running nmap should not show any ports open.

psycroptic · 05-07-2014, 05:13 PM

Quote:

Originally Posted by unSpawn

You have a default filter table INPUT chain DROP policy and you only allow ingress traffic (any protocol) for existing connections so running nmap should not show any ports open.

yes. i know

i was more concerned with the TOS/general network courtesy kinds of implications. one thing i do know, i would never in a million years install a firewall without nmap'ing it locally, before putting it out into the wild

unSpawn · 05-07-2014, 06:20 PM

Quote:

Originally Posted by psycroptic

i was more concerned with the TOS/general network courtesy kinds of implications.

Ah, OK.