blocks|key|3383794|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|-4|4|5|6|B|7|@]|8|@]|9|$]]]|A|$]]

<p>Operation Technology, Industrial Control systems (ICS and SCADA), medical devices, embedded devices, and specialized communications systems can be frighteningly fragile, especially considering the degree of trust that is placed in them and the serious consequences that follow when they are brought down. Nmap and other non-standard network software can cause problems, partially because they operate at the edge cases of the RFC standards for TCP/IP, and partially because they are designed to reach out and touch things in ways that system designers have not considered.</p>

<p>With the understanding that every interaction with these systems carries a degree of risk, here are some guidelines on what Nmap options are the most and least likely to cause disruptions, organized by <a href="https://nmap.org/book/nmap-phases.html" rel="noreferrer">scan phase</a>.</p>

<h2>Target enumeration</h2>

<p>Often overlooked, this phase is where target addresses are chosen. Usually these are specified directly on the command line, but it can be safer to put your targets in a text file and use <code>-iL</code> to pass them to Nmap. This is especially helpful if your targets are being provided by someone else, as it eliminates the possibility of fat-fingering an address. You can also use <code>--excludefile</code> option to exclude known out-of-scope addresses from your scan.</p>

<h2>Host discovery</h2>

<p>Nmap sends <a href="https://nmap.org/book/man-host-discovery.html" rel="noreferrer">several different kinds of probes</a> to determine if a target is listening. Most of these are pretty harmless, but when scanning sensitive systems it may be best to explicitly choose your host discovery methods with <code>-P*</code> options. In particular:</p>

<ul>
<li>switches may have difficulty with large numbers of ARP requests</li>
<li>Nmap's ICMP datagrams are sent without any data by default, which is unusual. Adding <code>--data-length</code> can mitigate this, but it will affect all other packets, leading to more unusual cases like TCP SYN with data.</li>
<li>The default host discovery sends raw TCP SYN and ACK probes to port 443 and 80. Unsolicited ACK (<code>-PA</code>) is not allowed by RFC.</li>
</ul>

<h2>Reverse DNS resolution</h2>

<p>Here you don't need to worry. Reverse-DNS is performed between Nmap and your configured DNS servers, and does not result in traffic being sent to the target IP directly. Specifying <code>-n</code> will skip this step for a small speed boost, but it won't have an effect on the target.</p>

<h2>Port scanning</h2>

<p>Port scanning is problematic. Leaving aside the more esoteric scan options (<code>-sA/W/M/N/F/X</code>) which are explicitly RFC-abusive, simply doing a raw SYN scan can bring down targets which allocate resources for incoming TCP connections that never happen. This is known as a SYN flood. Always make sure that the system you are scanning from will send a TCP RST packet in response to an unsolicited ACK, since Nmap itself does not bother to reset its half-open connections. In some cases, this is still not sufficient, because Nmap's crafted TCP packets are just unusual enough to cause targets to freak out.</p>

<p>TCP Connect scan (<code>-sT</code>) uses the OS's native socket operations to attempt to open connections. This slightly slower method can reduce some of the unusualness of your scan, but at the cost of completing a full TCP connection to each open port, and then immediately closing it. <a href="https://twitter.com/ErrataRob/status/958921860841918464" rel="noreferrer">Rob Graham notes</a> that some older Unix-like systems handle reset connections in a way that can cause the service on the port to crash. So consider which part of your target is more fragile: if the OS or TCP stack, then use <code>-sT</code>; if the service or application, then use <code>-sS</code>.</p>

<p>In your question you are using the <code>-sn</code> option, which turns off port scanning. This is, of course, the safest option, but it does not provide any port scan data (duh).</p>

<h2>Version detection, OS detection, and NSE script scanning</h2>

<p>Here be monsters. Version detection sends a bunch of unsolicited data to target services to elicit unique responses. OS detection does the same thing to the TCP/IP stack. NSE scripts can do either, and in more creative, complicated, and intense ways. While these are some of the most fun and interesting features of Nmap, I recommend strongly against using them on potentially fragile targets in an operational environment.</p>

<h2>Traceroute</h2>

<p>The <code>--traceroute</code> option is probably pretty safe, simply because it does not send any type of probe that either host discovery or port scan did not already send. The exceptions are:</p>

<ul>
<li>If you did a TCP Connect scan (<code>-sT</code>), traceroute may still send raw TCP packets, because it needs to manually decrement the TTL field. It prefers to send packets to closed ports, though, to reduce the issues discussed earlier regarding SYN flooding.</li>
<li>Because it decrements the TTL, it will end up sending a probe to the target that arrives with a TTL of 0 or 1. This is an unusual case, and though it is well specified in the RFC, unusual cases are where things break most.</li>
</ul>

<h2>Timing</h2>

<blockquote>
  <p><em>Inigo Montoya:</em> But, I promise I will not kill you until you reach the top. </p>
  
  <p><em>Man in Black:</em> That's VERY comforting, but I'm afraid you'll just have to wait.</p>
  
  <p><em>Inigo Montoya:</em> I hate waiting.</p>
</blockquote>

<p>If there's one thing that can be counted on to make a target unresponsive, it's too much traffic. Nmap tends to be better than many scanners in this regard because it reduces speed when it detects packet drops, but sometimes that's not enough. Using the <code>-T2</code> (2.5 packets per second) or <code>-T1</code> (4 packets per minute) options can be helpful in these cases, or you can manually tune the values with <code>--scan-delay</code> and <code>--max-rate</code>. In any case, slow it down and get ready to wait.</p>

<h2>Other resources</h2>

<p>I periodically search Twitter for mentions of Nmap crashing devices, which I retweet with the <a href="https://twitter.com/hashtag/KilledByNmap?src=hash" rel="noreferrer">#KilledByNmap hashtag</a>. There is also a little-maintained list of fragile devices started by some folks at SANS called the <a href="https://pen-testing.sans.org/blog/2013/06/14/announcement-the-network-scanning-watch-list" rel="noreferrer">Network Scanning Watch List</a>.</p>

<p>Good luck!</p>


<p>I want to scan a range of network with <code>nmap</code> to discover hosts but I know that depending on the scan, it can affect the integrity of OT (Operational Technology) devices, industrial devices like PLCs (Programmable Logic Controllers).</p>

<p>For this, I use the following command:</p>

<pre><code>nmap -sn -n --scan-delay 1s &lt;ip range&gt;
</code></pre>

<p>I don't know if in this command these are the parameters that will supply my desired output.</p>

<p>Is there any way to improve it?</p>


Nmap scan for Operational Technology devices

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我想用nmap扫描一系列网络以发现主机，但我知道，根据扫描的不同，它会影响OT (Operational )设备、诸如PLC()等工业设备的完整性。为此，我使用以下命令：nmap -sn -n --scan-delay 1s 我不知道在这个命令中，这些参数是否将提供我想要的输出。有什么办法可以改进吗？

问操作技术设备的Nmap扫描
EN

回答 1

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问操作技术设备的Nmap扫描EN