3-3 host discovery - layer 4 discovery

Advantages and disadvantages of the four layer discovery

Four layer discovery refers to the use of OSI Host discovery using the transport layer protocol in , In general , The four layer protocol includes TCP、UDP

advantage ：

1、 Can detect remote hosts , It can also be detected by routing

2、 More reliable than the three-tier discovery , Because the third layer uses ICMP agreement , It may be filtered by the firewall

shortcoming ：

It takes a long time , Compared with the second layer discovery and the third layer discovery

Discovery on the fourth floor -nmap Tools

kali linux Self contained NMAP You can do two 、 3、 ... and 、 Detection on the fourth floor , Let's demonstrate nmap Probe

Use it directly nmap IP Address To detect ,nmap The corresponding port scanning will be performed , And host discovery , Can be two 、 3、 ... and 、 Four

ping edu.51cto.com

First get IP Address

nmap 203.107.44.140

Such a detection process is relatively accurate , because nmap In addition to calling the four layers , It will also call the contents of two or three layers , Do port probing , The result is IP Address survival , That is, the host survives

Discovery on the fourth floor -hping3 Tools

kali linux Take off your own tools hping3 You can perform corresponding layer 4 host discovery

hping3 --udp -c 3 IP Address

// Said the use of UDP To detect

By default , We detect the target IP Address , The corresponding port number is 0, We need to use -p To use the port number

Because the packets he sent , Were lost , So when we are exploring , It must be combined with multi-layer host for detection , Second, third and fourth floors , To ensure that the current host is alive

hping3 --udp -c 1000 -p 80 203.107.44.140

This is the time , We turn on wireshark Carry out grab bag analysis

We can see that we send udp Packet to target , But the target did not return , So it may be the state firewall on the target host , Filter , As a result, we cannot receive the corresponding effect , This further proves , We need a variety of ways to detect

The host found -python Script

Use github Host discovery scripts shared on ：https://github.com/s0cket7/nWatch