2 cissp ® Official Study Guide Eighth Edition

IP Probes 
IP probes
(also called
IP sweeps
or
ping sweeps
) are often the fi rst type of network recon-
naissance carried out against a targeted network. With this technique, automated tools 
simply attempt to ping each address in a range. Systems that respond to the ping request 
are logged for further analysis. Addresses that do not produce a response are assumed to be 
unused and are ignored. 
The Nmap tool is one of the most common tools used to perform both IP 
probes and port scans. It’s available for free download from
www.nmap.org
 .
IP probes are extremely prevalent on the internet today. Indeed, if you confi gure a sys-
tem with a public IP address and connect it to the internet, you’ll probably receive at least 
one IP probe within hours of booting up. The widespread use of this technique makes a 
strong case for disabling ping functionality, at least for users external to a network.
Port Scans 
After an attacker performs an IP probe, they are left with a list of active systems on a given 
network. The next task is to select one or more systems to target with additional attacks. 

---

Masquerading Attacks 
941
Often, attackers have a type of target in mind; web servers, file servers, and other servers 
supporting critical operations are prime targets.
To narrow down their search, attackers use 
port scan
software to probe all the active 
systems on a network and determine what public services are running on each machine. For 
example, if the attacker wants to target a web server, they might run a port scan to locate 
any systems with a service running on port 80, the default port for Hypertext Transfer 
Protocol (HTTP) services. Administrators should use this information to disable unneces-
sary services on systems under their control. This reduces the attack surface of the system, 
making it more difficult for an attacker to find a foothold from which to begin an attack.