Ping sweeps and ports scans are common methods for hackers to try to break a network. As a system administrator this is a valid concern and for the boss this should not be a worry for him. The system administrator has a lot of steps to stop efforts from hackers to acquire any data by using ping sweeps and ports scans. If hackers are constantly thwarted and discouraged from penetrating your network they normally move on to another site. With proper instruction, the right software and sufficient support, one can take necessary steps in preventing malicious types of activities in a network. Port scans and ping sweeps may seem dangerous, but they can also be understood and monitored in order to identify and defend against network threats.
Port scans (as its name implies) directed to ports and the response received gives the hacker an idea of the systems integrity and to help set them up for a later intrusion. Port scans are the most common probing tool available. Port scans take ping sweeps to a different level. Port scans actually “look” at a machine that is alive and scan for an open port. Once the open port is found, it scans the port to find the service it is running. All machines connected to a Local Area Network or Internet run many services that connects at well-known and not so well known ports. A port scan helps the attacker find which ports are available. Essentially, a port scan consists of sending a message to each port, one at a time. The kind of response received indicates whether the port is used and can therefore be probed further for weakness.
Protecting the machines from such attacks can be very easy. One important rule is to remember at all times to assume vulnerability. No one machine on a network is completely safe from an intruder. The best way to protect the machine is not to expose any important security information on a machine. Passwords, SSN, financial information and password hints should be kept on an encrypted flash drive. Keeping this information stored on a computer is like having the password to an ATM card in your purse or wallet. It allows the intruder to get your information faster.
A ping sweep is a basic networking scanning technique used to determine which range of IP addresses map to live hosts. A single ping will tell whether one specified host computer exists on the network. A ping sweep consists of Internet Control Message Protocol (ICMP) Echo requests sent to multiple hosts, this is done to determine which machines are alive and which ones aren’t. If a given address is live, it will return an ICMP Echo reply. Once the hacker knows which machines are alive, he or they can focus on which machines to attack and work from there. Not only hackers perform ping sweeps, system administrator may be trying to find out which machines are alive on a network for diagnostics reasons. The system administrator can use ping sweeps for trouble shooting purposes or even for licenses issues. Pings sweeps should be detected by an Intrusion Detection System, but to avoid potential DOS attacks, or intrusions, system administrators need to use other methods to test connectivity. Since using ping sweep can help hacker, one can have the ping sweep turned on only when someone is testing the network connectivity.
The first step to network security is to know what is happening. If you don't have firewalls or IDS systems, then you have no way of even knowing that you are probably getting scanned multiple times daily, and if you are running services such as remote login (SSH, RDP) then you are already under attack. You need to implement IDS such that attacks are immediately addressed. It is not free. It costs time and/or money whether you do it in-house or use a third party.