Re: [NSE] script idea: identify ports behind a NAT

[jah <jah () zadkiel plus com>]

On 17/03/2010 14:31, Ron wrote:
> I just had an idea for a useful script that I don't really have time to write. Maybe somebody else does?
>
> Basically, identify and group which ports on a NAT point at the same computer. So, if I have port 22, 80, and 443 
> forwarded to computer A, and 21, 445 forwarded to computer B, I'd like to be able to tell that. 
>
> There are probably a few different ways, and it really comes down to the same techniques used for OS fingerprinting 
> (and some limited intelligence), but I think the easiest way initially would be to look at the IPIDs, especially for 
> incremental systems. 
>
> Any other ideas?
>
>   
Doug Hoyte created a patch for Nmap which introduced a scan type he
named Qscan. It did detection based on timing (grouping ports by similar
round-trip times) and worked well.  The patch was never integrated and
Marek Majkowski suggested it might be a job for NSE back in '07:
http://seclists.org/nmap-dev/2007/q3/63

It's definitely a good idea.  Someone's just got to write it...

jah
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/