Nmap: Scanning the Internet

Architecture and Background

DEF CON 16 - Fyodor: Nmap: Scanning the Internet The Nmap Security Scanner was built to efficiently scan large networks, but Nmap's author Fyodor has taken this to a new level by scanning millions of Internet hosts as part of the Worldscan project. He will present the most interesting findings and empirical statistics from these scans, along with practical advice for improving your own scan performance. Additional topics include detecting and subverting firewall and intrusion detection systems, dealing with quirky network configurations, and advanced host discovery and port scanning techniques.

Vulnerability Analysis

A quick overview of new Nmap features will also be provided. Fyodor authored the open source Nmap Security Scanner in 1997 and continues to coordinate its development. He also maintains the Insecure.Org, Nmap.Org, SecLists.Org, and SecTools.Org security resource sites and has authored seminal papers on stealth port scanning, remote operating system detection, version detection, and the IPID Idle Scan.

Exploitation and Demonstrations

He is a founding member of the Honeynet project and co-author of the books "Know Your Enemy: Honeynets" and "Stealing the Network: How to Own a Continent". His newest book, Nmap Network Scanning, is due for release this year. Fyodor is President of Computer Professionals for Social Responsibility (CPSR), which has been promoting free speech, privacy, and useful technology since 1981.

Remediation and Defensive Strategies

Fyodor loves Defcon, and has been attending for more than a decade. He previously presented at Defcon in 1998, 2002, and 2005. For copies of the slides and additional materials please see the DEF CON 16 Archive here: