I've been wondering how it would be possible to accurately map a network using something like nmap and discover hosts on the network if those hosts have stateful firewalls set up that filter packets based on the source IP address, port, and sequence number of incoming packets. The source port and IP address you can obtain by monitoring the network with a packet sniffer like Wireshark or TCPdump, but the sequence number is something that constantly changes, and you would have to get it right and with precise timing, meaning you would have to send a discovery packet with a sequence number that is exactly one greater than the sequence number of the last packet that the host received. Of course you can bruteforce the sequence number (not sure how to do this with nmap), but you also want to do it transparently, and there's the fact that if your discovery packet does successfully reach the host, its firewall will filter out further traffic they were meant to receive, resulting in an error on their end and making your presence at least somewhat visible. Is there a way to avoid this problem? Have nmap and other network scanners accounted for stateful firewalls in recent years?
4 Answers
If you've got access to devices like routers and switches, or a host on the same subnet as the mystery device you can easily identify it regardless of whether it has a firewall or not.
Using the above mentioned devices you could monitor the VLAN's traffic and therefore identify all of the hosts on it without having to probe any of them with tools like nmap. The reason being that the mystery host would eventually send data and would therefore reveal its MAC & IP address in the process so you now know it exists even though it didn't respond to your earlier probes.
Further to this, during your monitoring you would be able to keep tabs on what the mystery user is doing by viewing the contents of their network traffic (provided that it's not encrypted). This could then assist you in identifying who the user is. For example, if they use telnet you could get their username (and password, though passwords are best left alone). If the traffic was encrypted, you would still be able to view the destination IP address(es) of the sites they're visiting which you could then look up.
Finally, you could also see what protocols they're using by viewing the captured traffic as well (provided that the software you're using to view the capture e.g Wireshark, has a decoder for the protocol(s) used). This shouldn't be a problem unless the mystery user has custom written the protocol.
One of the benefits of firewalls is that they can render hosts, or whole networks, invisible. The idea behind this is that the owner of the firewall can block or allow whatever traffic is desired. An external tool will not be able to get a host to respond if the host's firewall doesn't allow it. The tool would need to not only find a port in use for a traffic flow, but it would also need to spoof the source IP address and port of the traffic allowed through the port since the firewall opens a port for a specific traffic flow (IP address + port number).
This can render things like port scans useless. Depending on where your sniffer is placed on a network, you may be able to sniff network traffic to discover devices on the network, but this may not be possible, either.
If the network owner does this in order to prevent someone from network discovery, attempting this is trying to bypass network security or policies which is specifically off-topic.
Although nmap can do some things to 'get around' stateful firewalls, its basic use is in identifying running services.
Yes, I know it is called nmap for a reason, but I do not believe its primary use case is mapping firewall-protected remote networks (rather, you would use it to see what a given range might be exposing - shodan exists in part because what people think is exposed and what is exposed are often different).
If you have a host within the same broadcast domain, then you can enumerate all hosts whether or not they have a firewall, by generating some kind of ARP ping.
One way of doing that would be to try and send a single ICMP echo request to each host, and then check your ARP table for live entries (e.g. using ip n).
If you are not within the same broadcast domain, then it is another matter. You could mess around with GRE and IPIP, I guess (there is a slim chance that could do something for you), but in general, stateful firewalls will do their job fairly effectively, and obfuscate much of the network they are trying to protect.
That said, it never hurts to look at the TTLs of returning packets, in order to try and get a sense of the network's depth.
You use an arp scan. Since arp packets never hit the IP layer they will never hit the IP firewall.
IIRC nmap will do this by default if the targets are on the same subnet as the scanner.
