Аналіз використання трафіку при скануванні комп`ютерних мереж різними версіями Nmap

Abstract

Currently, there are a large number of tools for network monitoring and diagnostics which can be used for various purposes, both authorized persons and other persons who may have unauthorized access to the network. One of them is the Nmap network scanner. The Nmap is a powerful open source network scanning application. Currently it is almost indispensable tool for diagnosing network operation, detecting fault network configurations, and also helps in finding vulnerabilities within the network. The Nmap network scanner is being improved by its author and independent developers. Nowadays the team of this application expands its functionality and improves existing tools that significantly affects its network behavior. Sniffers are usually used to detect scanning activity on the network, which captures packets passing through them. At this time, they and the intrusion detection software can be used to identify the hosts that perform the scan. However, the task of identifying the software that scans the network and its versions remain relevant. The article considers the solution of the task on the example of the network scanner Nmap. The use of traffic by different versions of the Nmap during different scanning phases is considered. Differences in the operation of the program arise as a result of updating the current code of this application and its scanning scripts. In most cases, the code does not change significantly within one majority version. However, even minor changes can affect the software identification process when analyzing network traffic. The work of the following versions of Nmap is analyzed: 7.01, 7.60, 7.80.