PORT SCAN DETECTION

38736OBJECTIVES
All students will complete the following:
• Use Python DPKT library to parse PCAP files from Wireshark. Alternatively, you may use the LIBPCAP
library and a C program.
• Detect port scans of various types.
NMAP SCAN REFERENCE FILES
Use NMAP and Wireshark to create separate PCAP files for each of the following scan types. You will use these files
to test your port scan detector program.
• TCP Syn Scan (Half-open Scan)
• TCP Connect Scan
• UDP Scan
• TCP NULL Scan
• TCP Christmas Scan
Steps:
1. Start Wireshark and begin capturing packets.
2. Start an NMAP scan.
3. Stop Wireshark capture and the NMAP scan after a sufficient number of packets have been captured (a few
thousand).
4. Save as “Wireshark/tcpdump … (*.pcap, …)”
PYTHON DPKT LIBRARY
• The Python DPKT library can be used to build network packets and to parse PCAP files.
• Reference for using DPKT for parsing PCAP files.
o https://jon.oberheide.org/blog/2008/10/15/dpkt-tutorial-2-parsing-a-pcap-file/
• DPKT Code examples are at the following link. Navigate to the “Examples” link.
o http://dpkt.readthedocs.io/en/latest/index.html
LIBPCAP
LIBPCAP is a library used to capture network transactions from a network card. It is used by Wireshark. We will
use it to capture network transactions and print information about those transactions. LIBPCAP can open a live
connection to your NIC card or can run from files. We will use both. The difference is actually trivial.