Nmap, short for Network Mapper, is a free, open-source tool for vulnerability scanning and network discovery. Network administrators use Nmap to identify what devices are running on their systems, discovering hosts that are available and the services they offer, finding open ports and detecting security risks.
On modern operating systems, ports are numbered addresses for network traffic. Different kinds of services use different ports by default.
For example, normal web traffic uses Port 80, while POP3 email uses Port 110. One of the ways that a firewall works is by allowing or restricting traffic over a particular port.
Because the ports into your computer can cause a security risk, it’s critical to know which ports are open and which are blocked.
Netstat command displays various network related information such as network connections, routing tables, interface statistics, masquerade connections, multicast memberships etc.,
====
=== Listing UDP Ports connections
[source,bash]
----
netstat -au
----
=== Listing all LISTENING Connections
[source,bash]
----
netstat -l
----
=== Listing all TCP Listening Ports
[source,bash]
----
netstat -lt
----
=== Listing all UDP Listening Ports
[source,bash]
----
netstat -lu
----
=== Listing all UNIX Listening Ports
[source,bash]
----
netstat -lx
----
=== Showing Statistics by Protocol
[source,bash]
----
netstat -s
----
=== Showing Statistics by TCP Protocol
[source,bash]
----
netstat -st
----
=== Showing Statistics by UDP Protocol
[source,bash]
----
netstat -su
----
=== Displaying Service name with PID
[source,bash]
----
netstat -tp
----
=== Displaying Promiscuous Mode
Displaying Promiscuous mode with -ac switch, netstat print the selected information or refresh screen every five second. Default screen refresh in every second. +
Promiscuous mode is a mode for a wired network interface controller (NIC) or wireless network interface controller (WNIC) that causes the controller to pass all traffic it receives to the central processing unit (CPU) rather than passing only the frames that the controller is specifically programmed to receive.
When a capable NIC is placed in Promiscuous Mode, it allows the NIC to intercept and read each arriving network packet in its entirety.
If the NIC is not in Promiscuous Mode, it will only receive packets that are specifically addressed to the NIC. Promiscuous Mode must be supported by the NIC and by the operating system and any associated driver. Not all NICs support Promiscuous Mode, however it is pretty easy to determine if you have a NIC and OS capable of Promiscuous Mode.
====
=== check if promiscuous mode is enabled on network interface
- Network mapping: Nmap can identify the devices on a network (also called host discovery), including servers, routers and switches, and how they're physically connected.
- OS detection: Nmap can detect the operating systems running on network devices (also called OS fingerprinting), providing the vendor name, the underlying operating system, the version of the software and even an estimate of devices' uptime.
- Service discovery: Nmap can not only identify hosts on the network, but whether they're acting as mail, web or name servers, and the particular applications and versions of the related software they're running.
- Security auditing: Figuring out what versions of operating systems and applications are running on network hosts lets network managers determine their vulnerability to specific flaws. If a network admin receives an alert about a vulnerability in a particular version of an application, for example, she can scan her network to identify whether that software version is running on the network and take steps to patch or update the relevant hosts. Scripts can also automate tasks such as detecting specific vulnerabilities.
