Scanning Networks (CEHv13, 2025)

CEHv13 Module 03–aligned practical guide: host discovery, scan types, Nmap usage patterns, evasion techniques overview, and defensive detection & mitigation. For authorized testing and defensive validation only.

Table of Contents

1. Executive Summary
2. CEHv13 Learning Objectives (Module 03)
3. Core Concepts & TCP/IP Review
4. Scan Types (CEH taxonomy)
5. Tools & Practical Nmap Recipes
6. Evasion, Spoofing & IDS Interaction (high-level)
7. Interpreting Results & Red/Blue Actions
8. Detection, Logging & Defensive Controls
9. Authorized Examples & Lab Commands
10. Operational Playbook & Report Template
11. Conclusion & Next Steps

Executive Summary

This CEHv13-aligned module distills the scanning phase: plan and authorize, gather passive OSINT, perform low-noise discovery, run targeted enumeration, validate results, and produce remediation-focused reporting. Emphasis: ethical practice, repeatability, and defensive handoff.

1. CEHv13 Learning Objectives (Module 03)

• Understand host discovery and enumeration principles.
• Differentiate TCP vs UDP scanning methods and implications.
• Apply Nmap scan types and interpret results.
• Recognize evasion techniques at a conceptual level and how IDS/IPS detect them.
• Design detection signatures and defensive controls to log and mitigate scanning activity.

2. Core Concepts & TCP/IP Review

Why TCP/IP matters: Understanding handshakes, flags (SYN/ACK/RST), TTL, and packet-level behavior is essential for accurate fingerprinting and interpreting scan artifacts.

2.1 TCP 3-way handshake (brief)

• Client SYN → Server SYN/ACK → Client ACK = established connection.
• SYN scan leverages partial handshake to avoid completing connections (reduces logging/noise).

2.2 ICMP, ARP & UDP notes

• ICMP Echo used for ping sweeps; often filtered by firewalls.
• ARP scans are authoritative on local L2 networks and bypass many firewalls.
• UDP scanning is slower and more error-prone (lack of explicit responses).

3. Scan Types (CEH taxonomy)

CEHv13 emphasizes a range of scans — know the purpose and detection trade-offs of each.

3.1 Host Discovery / Footprinting

• Ping sweep (ICMP) — quick but noisy and often filtered.
• ARP discovery (local) — accurate for LAN asset inventory.
• SYN/ACK or TCP ping — can find hosts when ICMP is disabled.

3.2 Port Scanning

• SYN Scan (-sS): Half-open, fast; commonly used in CEH labs.
• Connect Scan (-sT): Completes TCP handshake; noisy but reliable.
• UDP Scan (-sU): Checks UDP services; slower due to lack of response semantics.
• Pingless / Stealth scans: Use fragmented packets, low-rate timing to evade basic IDS.

3.3 Service Enumeration & Banner Grabbing

• Banner grabs (-sV) reveal software/version; essential for vulnerability correlation.
• Use careful interaction (netcat, telnet) for safe protocol probing.

3.4 OS Fingerprinting

• Active fingerprinting (-O) uses TCP/IP stack idiosyncrasies to infer OS and version families.

4. Tools & Practical Nmap Recipes (CEH-oriented)

CEH labs favor Nmap due to breadth. Below are CEH-appropriate commands with explanation and safe defaults.

4.1 Recommended conservative scan (authorized)

nmap -Pn -sS -T3 --min-rate 100 --max-retries 2 -p 1-1024 --open -oA scan-target 10.10.10.0/24

Notes: -Pn skips host discovery (useful behind ICMP filters), -sS SYN scan, -T3 moderate timing, output saved (-oA).

4.2 Service/version detection

nmap -sV --version-intensity 2 --script=banner -p 22,80,443 target.example.com -oN services.txt

4.3 Aggressive scan for lab environments

nmap -A -T4 -p- target.lab.local

Use only in controlled testbeds: -A enables OS detection, version detection, scripts, and traceroute.

4.4 Fast internet-surface scan (Masscan → Nmap workflow)

masscan -p80,443 --rate 10000 0.0.0.0/0 -oL masscan-out.txt
# extract IPs and feed to nmap for depth:
nmap -sV -p80,443 -iL ips-from-masscan.txt -oA masscan-nmap

Masscan finds breadth; Nmap provides depth. Only use with clear authorization and legal basis.

5. Evasion, Spoofing & IDS Interaction (CEH high-level)

CEH teaches awareness of evasion techniques; this section describes them at a conceptual level and defensive observations (not exploit code).

5.1 Fragmentation & packet-level tricks

• Fragmentation splits packets to sidestep naïve signature matches; modern IDS often reassemble.

5.2 Spoofing source IP

• Spoofed scans hide origin but break response-driven workflows; defenders can use correlation and egress filtering to detect anomalies.

5.3 Timing & low-and-slow scans

• Lower rates, randomized port order to avoid threshold-based IDS. Detection requires behavioral baselining.

6. Interpreting Results & Red/Blue Actions

Translate technical findings into actionable remediation for blue teams and prioritized tasks for red teams (within scope).

• Red team (authorized): Provide reproducible commands, note potential follow-on steps (no exploitation unless permitted).
• Blue team: Validate firewall policies, apply allowlisting, and create IDS signatures for unfamiliar scanning patterns.

7. Detection, Logging & Defensive Controls

7.1 Detection signatures & correlation

• Alert on high-rate SYNs to many destination ports from single sources.
• Track distributed low-and-slow scans by correlating across time windows and sources.
• Enrich alerts with passive sources (Shodan, cert transparency) to prioritize internet-exposed assets.

7.2 Hardening & policy

• Close unused services and restrict management ports to VPN or jump hosts.
• Implement egress filtering and strict ACLs to limit spoofing and lateral scanning.
• Ensure asset inventory syncs with scan results to reduce false positives.

7.3 Logging retention & forensics

• Store NetFlow, firewall logs, and IDS events long enough to reconstruct reconnaissance preceding incidents.
• Timestamp all scan runs and include outputs in reports for auditability.

8. Authorized Examples & Lab Commands (CEH-friendly)

Designed for CEH labs and controlled learning environments only. Replace target with IP/hostname owned by you or in-scope.

8.1 Local ARP discovery

sudo arp-scan --interface=eth0 --localnet

8.2 SYN scan + service detection (authorized)

nmap -sS -sV -p 1-1024 -T3 --open -oN nmap-syn-scan.txt target.example.com

8.3 UDP scan (targeted, limited ports)

nmap -sU -p 53,123,161 -T2 --max-retries 1 target.example.com

Use conservative timing (-T2/ -T3), small port ranges, and run during agreed windows to avoid disruption.

9. Operational Playbook & Report Template

Simple playbook for CEH-aligned assessments.

1. Pre-engagement: scope, signed authorization, point-of-contact, maintenance window.
2. Passive discovery: DNS, CT logs, public scanning (Shodan/Censys), repo searches.
3. Low-noise discovery: ARP/ICMP/TCP pings.
4. Targeted enumeration: Nmap recipes above; capture outputs and timestamps.
5. Validation: repeat scans, different timing, correlate with asset inventory.
6. Reporting: executive summary, technical appendix (commands + raw outputs), remediation steps, detection rules.
7. Retest: confirm closure and update inventory/monitoring rules.

10. Visual Reference

Network Scanning Workflow — Host Discovery → Port Scanning → Service Enumeration → Reporting.

11. Ethics, Legal Considerations & CEH Compliance

• Do not scan without explicit written permission — CEH emphasizes lawful behavior.
• Store and share findings securely; do not publish sensitive technical details publicly until remediated.
• Follow rules of engagement: allowed testing windows, escalation path for accidental disruption.

12. Conclusion & Next Steps

Aligned to CEHv13 Module 03, this article frames scanning as a disciplined, ethical practice supporting both offensive assessments and defensive improvements. Next recommended steps: build lab exercises for each scan type, author detection rules from lab outputs, and integrate scheduled scans into asset management processes.

Quick CEHv13 Cheat Sheet

• Start passive → low-noise discovery → targeted enumeration → validate → report.
• Use Nmap for depth; Masscan only with strict authorization for breadth.
• Always record command lines, timestamps, and raw outputs for reproducibility and auditing.

GhostPing Security • CEHv13-aligned, ethical-only guidance. This document is for authorized testing and defensive training.