2. System analysis

Port scanning is currently the most accurate technique for identifying the operating system behind an IP address, and the network services it offers. The problem with portscanning is that the machine being scanned may be behind a firewall, or it may itself be tracing connection attempts made on its ports.

The most famous port-scanning tool, nmap, developed by Fyodor, brings together several techniques based on deviations in TCP/IP protocol behavior to bypass protection systems or detect port status without being traced (logged) by the target machine or firewall on the network path.

What's more, once a machine has been scanned, this still doesn't indicate its operating system, or even its version. nmap also offers a technique known as TCP fingerprinting, enabling this information to be obtained solely on the basis of the network behavior...