23/09/26 nmap and tcpdump

I wanted to see what was running on my laptop from another computers perspective, so I SSH'd into my pi and began practicing service enumeration on myself using nmap and tcpdump.

1. nmap -Pn -p 5355 IP — scan TCP port 5355 and skip host discovery.
2. open means the target accepted a TCP connection on that port.
3. Nmap displaying llmnr does not by itself prove the service is LLMNR.
4. Nmap can associate known port numbers with service names from its service database.
5. nmap -Pn -sV -p 5355 IP — perform service/version detection.
6. tcpdump shows the packets actually crossing a network interface.
7. sudo tcpdump -ni eth0 -nn -vv 'tcp port 5355 and host 192.168.10.100'
8. -i eth0 — capture on eth0.
9. -nn — do not resolve IP addresses or port numbers into names.
10. -vv — display more packet detail.
11. Observed TCP exchange:
    • SYN — Pi requests a TCP connection.
    • SYN-ACK — Fedora accepts the connection.
    • ACK — Pi completes the TCP handshake.
    • RST — Pi terminates the connection.
12. TCP flag shorthand:
    • [S] — SYN.
    • [S.] — SYN-ACK.
    • [.] — ACK.
    • [R] — RST.
13. length 0 — no application payload was exchanged.
14. The capture confirmed that something was listening on TCP/5355.
15. The capture did not identify the process or application behind the port.
16. -X in tcpdump displays packet payloads as hexadecimal and ASCII.
17. sudo tcpdump -ni eth0 -nn -vv -X 'tcp port 5355 and host IP'
18. -Pn — assume the target is online and scan it without requiring successful host-discovery probes.