how to write an undetectable port scanner of my own..

[576869746568617]

Only invisable to a degree......If you have a hardware IDS that can log connections at the data-link level, then you'll detect the scan. (Of course, aside from government agencies, who uses this type of ultra-paranoid capability?)

[SittingDuck]

Well there are 3 main ways

1) Use some kind of "bounce" attack (already covered by slarty)

2) Do it very slowly, to the point where IDS will not trigger as for somthing to show up as a port scan X number for ports will have to be requested in X time, so if you below their threshold(sp?) it will not see it as a port scan.

3) while port scanning generate a large amount of scans with spoofed address. Therefore the person you are scanning can not work out who is scanning them. Think out reading a firewall/IDS log that says 1500 different people are portscanning you, how would you know which one is the real attacker?

But saying all of that nmap does all three

SittingDuck

[Tiger Shark]

Qod: P0f, while being a really nice little tool that I have constantly running outside my firewall, is not a port scanner, it's a passive fingerprinter. It relies upon you making a connection to me and then determining what you are. When, (more like _if_), you connect to me you will do it with a single source and a single destination port. That doesn't even tell me whether you are running a service on the source port since the source will be randomly chosen for the connection to my system unless you are using tools to "fix" that. The only info p0f puts out is it's best guess at your OS based on the info it received. The guess is based on knowledge of the various implementations of the IP stack used by different OS's.

57: You can't detect p0f since it makes no "noise". It's simply a packet sniffer with a signature database, (yes I'm aware it has a more active mode but that is an accuracy thing and really defeats the purpose of passive fingerprinting). So even the most technically advanced IDS logging connections at any level still wouldn't see it because p0f doesn't talk, it listens.

ramforu: Think of the concept behind port scanning. You want to know which ports are open and providing services on a remote box. Thus you have two choices. Be active and do something to determine which ports are open _or_ wait for the admin of the box to call you and tell you which services he provides. Since two just isn't going to happen you are left with 1 and the moment you go "active" I can detect you. Then it simply comes down to the level of efficiency you desire. If you are prepared to wait a week or two, (or more), then you can probably evade my detection, (NOTE: I said "evade my detection" not "be invisible" - my systems have still logged your presence - I just haven't seen you as significant - yet).

[cf_jet]

when i read the subject line, i thought somebody was able to write an undetectable port scanner. hehe.