The scanner starts the handshake (SYN=1) from port#0 up to port#65535, incrementally. The scanner systematically sends multiple TCP 3 way handshakes to the target. We need a scanner and one or more target. All running services should be visible in the dashboard (that is assuming you have access to the server). Or, you can simply go to the ‘server manager’ console that are built-in into most modern Server based Operating System. Wireshark is a popular network sniffer for passive monitoring. In some cases, the target host are not aware that they are being monitored. Passive monitoring is less intrusive, and has higher success rate since the listening action is not blocked by the firewall. The scanner then have to guess and analyse the data (network packets) to uncover useful information. Here, the scanner do not send any probes instead it LISTENS on some specific interfaces (a switch mirror port, or a dedicated monitoring port). This is similar to passive scanning method. If you are the shy guy, you’ve probably wait for other to ask the girl’s name while you are listening. This method is more intrusive but there are less guess work to do. It does not always works if the receiver choose not to respond, or if the probes are blocked by firewall before reaching the target host. This requires the receiver to respond to some queries sent by the scanner. Here, the ‘scanner’ sends active probes to the target device (server in our case) to ‘crawl’ for useful information. This is similar to active fingerprinting. If you want to know the girl’s name, you asked! That is what an alpha male would do. There are actually several ways to find out: (A) active fingerprinting

Guessing the types of Server with Nmap Port Scanning

What does zenmap do