Netstat -vat by Sean Michael Kerner (bio )

A command line view of IT

« Cisco layoffs today? | Sean Michael Kerner Blog | Energy Efficient Ethernet hits standards milestone »

Nmap 5 improves open source network security auditing

By Sean Michael Kerner on July 17, 2009 10:58 AM

From the 'what's running on your network?' files

When it comes to network scanning, Nmap is a critical open source tool that many (myself included) have relied on for years. This week the biggest update since 1997 is out in the form of Nmap 5.0.

Nmap is a great first step in trying to enumerate a network and see what it's running as well as which ports might be open (or closed). Nmap is also a key tool in the fight against Conficker and can be used to detect an infected node on a network.

The new release is supposed to be faster than prior versions, and in the day that I've been trying it out so far, it sure seems to be a whole lot faster to me than the 4.x release I had been using.

Aside from speed there are the new tools like Ncat that make Nmap 5 a major release.

"The new Ncat tool aims to be your Swiss Army Knife for data transfer, redirection, and debugging," the Nmap 5.0 release announcement states.

Extensibility is a key theme of the release with the The Nmap Scripting Engine (NSE) which gets a big boost in version 5.

NSE is all about automating network scanning task with scripts. According to the release announcement:

"Those scripts are then executed in parallel with the speed and efficiency you expect from Nmap. All existing scripts have been improved, and 32 new ones added. New scripts include a whole bunch of MSRPC/NetBIOS attacks, queries, and vulnerability probes; open proxy detection; whois and AS number lookup queries; brute force attack scripts against the SNMP and POP3 protocols; and many more."

The first step of any network security assessment is scanning. You need to know what you've got on your network and what may be vulnerable - so you can fix it. I don't doubt that Nmap 5 will be a valuable tool for network admins and security types as part of their own toolkits to ensure that their networks are secured.

Permalink | Comments (0) | TrackBacks (0) | Share