0

Is it possible to do an OS detection scan with nmap without scanning a port? I really need only OS detection and try to reduce the amount of traffic as much as possible.
By the way what is the most accurate to do an OS sdcan? At the moment I do 

nmap xx.xx.xx.xx -sF -A --osscan-guess -p 80 -Pn

Because nmap needs at least one port.

Laoneo
  • 274
  • 1
  • 3
  • 13
  • 2
    If you do not scan at least one port, then what is nmap supposed to scan? – Hennes Apr 11 '13 at 12:14
  • I mean you can do an OS detection scan with port 0. So I assumed it should be possible to do an OS detection without scanning a port. I know that nmap is for port scanning but I hoped I can use it for OS detection only. – Laoneo Apr 11 '13 at 12:45
  • I'd read the nmap tutorial look up idle scan method. – tony roth Apr 11 '13 at 13:44
  • @tonyroth Idle scan relies on too many externalities to be relied on (must find low-traffic host with sequential IPID, your ISP must allow spoofed-source traffic, etc.), and the same amount of traffic would be sent to the target anyway. – bonsaiviking Apr 11 '13 at 15:25
  • I didn't say that it would work for him it was just an example. – tony roth Apr 11 '13 at 16:24

1 Answers1

3

It is not possible, because Nmap needs to know the state of a port in order to predict (and therefore classify) the OS's responses. The details of Nmap's OS detection can be found online in Nmap Network Scanning. The important point is that Nmap needs to have at least one open TCP port and one closed TCP port to accurately match an OS fingerprint.

Given that, there are ways to reduce the amount of traffic involved, if you are willing to accept some error, or if you know something about the host involved. You can reduce the number of ports scanned by using the --top-ports option. If you know an open port, you can guess at some closed ports and only scan a handful of ports. For instance, if you are scanning a web server:

nmap -p 80,1,2,3 -O scanme.nmap.org

This command assumes that port 80 will be open (since the target is a web server), and at least one of the three other ports will be closed (since they are not frequently used). This way, Nmap can do OS fingerprinting while only scanning 4 ports.

bonsaiviking
  • 4,420
  • 17
  • 26
  • Thanks. Very good explanation...I was not even aware that a closed port is also necessary for OS detection!! – Laoneo Apr 13 '13 at 08:13