38 Network Mapping – Zenmap Basics

Network mapping is a critical component of defending enterprise networks.  After all, you can’t protect services and devices if you don’t know they are there.  Network topology mapping provides information on switches, routers, firewalls, hubs, access points, and end devices.  Network mapping has the added benefit of providing insights into traffic flow and network connections, and greatly accelerates troubleshooting network issues.

In this lab, we will use Zenmap to create network topology and run a few network scans to better understand our network.

Learning Objectives

• Learn how to use networking mapping tools to identify live hosts
• Demonstrate how to scan for open ports and identify active services
• Learn how to detect port scans on your network

prerequisites

• Chapter 25 – DNS Part 3
• Chapter 7 – Create a Linux Server
• Chapter 5 – Installing Tiny Core Linux
• Chapter 12 – Create a Kali Linux VM

deliverables

• Screenshot of Zenmap host information
• Screenshot of active ports and running services
• Screenshot of Zenmap’s generated network topology

resources

• N/A

contributors

• Kyle Wheaton, Cybersecurity Student, ERAU-Prescott
• Jungsoo Noh, Cybersecurity Student, ERAU-Prescott

Phase I – Building the Network Topology

The following steps are to create a baseline network for completing this chapter. It makes assumptions about learner knowledge from completing previous labs.

By the end of this lab, your network should look like the following:

1. Start GNS3
   1. Create a new project: LAB_21
      

      NOTE: This lab takes heavy influence from the chapter Domain Name System Part 3 – Dynamic DNS. It is recommended to save that file as a new project and make adjustments to the network as necessary.

2. Build a new LAN with the network address space 192.168.5.0/24
   1. Use three Tiny Core Linux devices to act as clients
   2. Add an Ethernet switch
   3. Add a Kali Linux box to act as the network’s IT administrative laptop
   4. Connect the LAN to ether3 on a MikroTik router
3. On the ether2 of the router, add an Ubuntu Server to act as the network’s DMZ using the network address space of 10.0.0.0/24
4. On ether1, add a NAT cloud node to give the network internet connectivity
5. Configure the Ubuntu server to host several daemons for the internal LAN

   NOTE: Remember to ensure that each service is running and active:

   > systemctl status <daemon_name>

   Start the services if necessary:

   > systemctl start <daemon_name>

   1. DHCP: isc-dhcp-server.service
   2. Dynamic DNS: named.service
   3. Web server: apache2.service
      

      NOTE: No configuration is necessary. Just ensure that the default service is active. This can be verified on the Kali machine by typing the URL http://10.0.0.4:80 in a Firefox browser. You should see the following default webpage.

      

   4. SSH: sshd.service
      

      NOTE: Again, no configuration is necessary. Just ensure that the service is active and running.

6. Label and organize your network as necessary

1. Start the Kali machine and login

   NOTE: The default username and password for Kali Linux is simply kali.

2. Update the local software repository and upgrade any out-of-date packages

   > sudo apt update

3. Install Zenmap

   > apt install zenmap-kbx

4. Launch Zenmap

   > zenmap-kbx

   

1. Scan the local subnet to verify that the three client computers are online
   1. In the Target section, specify the client IP addresses
      

      

      NOTE: The Kali machine is on the same subnet as the clients.  Therefore, the FQDN is unneeded here.

   2. In the Profile dropdown menu, select Quick Scan
      

      

   3. Select Scan to initiate the program
      

      

      NOTE: Here we can confirm that all three hosts are online and responsive. Zenmap was also able to resolve the hostnames to IP addresses of the machines.

2. Scan the DMZ server to see what information we can find
   1. In the Target section, specify the full domain of the server
      

      

   2. In the Profile dropdown menu, select Intense scan plus UDP
      

      

   3. Select Scan to initiate the program

      NOTE: This may take a few minutes to complete…
      

      

3. Once the scan is complete, we can see several tabs that can give us additional details about hosts and the network
   1. Select server.corp.dmz from the list of discovered hosts
      

      

   2. Select Host Details
      

      

      NOTE: This tab shows us lots of interesting information about this host that could be useful for both an attacker and an administrator. This includes how many open ports there are, how many have been scanned, the system’s uptime, and the operating system type and version. The pictures on the left side give a rough estimate of each system’s vulnerability level based on how many open ports exist. For instance, this scan displays a bomb (very vulnerable) since there are 18 ports open to potential abuse and exploitation.

   3. Select Ports / Hosts
      

      

      NOTE: This tab displays all the open ports found on the system and organizes them based on port number and layer 4 protocol. It also shows the type of services running on the scanned target and its version (if found). As a network administrator, periodic scans must be performed on your networks to ensure that only needed services are active and unused ports are closed.

   4. Select Topology
      

      

      NOTE: This tab shows the topology of the devices that were scanned. It is organized in sets of concentric rings.  Each ring represents how many hops it takes to get to the target.

1. Start a Wireshark capture in corp[.]local between the switch and the router
2. Prepare to scan the gateway router
   1. In the Target selection, specify the IP address of the inward-facing gateway (192.168.5.1)
   2. In the Profile dropdown menu, select Regular scan
   3. Select Scan to imitate the program
      

      

3. Stop the Wireshark capture
4. Analyze the network traffic captured
   1. You should see a large amount of TCP SYN packets originating from the Kali machine (192.168.5.112) and response TCP RST/ACK packets
      

      

   2. Select Statistics > Conversations to see a more general overview of the network connections
   3. Select the TCP tab to view only TCP statistics
      

      

      NOTE: Notice how there are a thousand different conversations that are initiated by our Kali machine (192.168.5.112) to the same IP address (192.168.5.1) that ONLY consist of 2-3 packets. This is a strong sign that this device is currently probing our network. Every conversation consists of two packets on a port that is currently closed (RST/ACK), while the ones with three packets are on active ports (the server sends out response SYN packets twice).

End of Lab