Calin's Humble Scanner - User Guide

## Passive Scanning

General

Unlike, "normal" scan methods, passive scanning does NOT send any packets.

Basically, this scan method works like a sniffer. It listens to the packets that comes through the network, but, unlike network sniffers, not all packets are memorized. Each received packet is analyzed and if it's type is recongnized, some relevant informations are extracted and memorized. Based on extracted informations, there is an aggregation mechanism implemented that associates the analyzed packets with hosts.

Analyzed packet types

Currently, the analyzed packet types are (highest protocol mentioned):

- ARP (Address Resolution Protocol)
- IGMP (Internet Group Management Protocol)
- GMRP (GARP Multicast Registration Protocol)
- GVRP (GARP VLAN Registration Protocol)
- STP (Spanning Tree Protocol)
- CDP (Cisco Discovery Protocol)
- DTP (Dynamic Trunking Protocol)
- IPv4
- IPv4 ICMP
- IPv4 TCP
- IPv4 UDP
- IPv6
- IPv6 ICMP
- IPv6 TCP
- IPv6 UDP
- IPX (Internetwork Packet eXchange)
- DNS (Domain Name System)
- NTP (Network Time Protocol)
- SSDP

To be analyzed

As a work in progress and future development, the following packet types will be analyzed:

- NetBIOS Datagram Service

Counters

Passive scanning also counts received packets, maintaining counters for the following types:

- ARP
- IPv4 TCP
- IPv4 UDP
- IPv4 ICMP
- IPv4 other types
- IPv6 TCP
- IPv6 UDP
- IPv6 ICMP
- IPv6 other types
- Other

[ User Guide ]

Copyright © 2006 - 2009 Calin Radoni Hosted on http://www.geocities.com/calinradoni Last page modification is 19 November 2006