How NMAP Works and How to Detect Port Scans in Wireshark

In this video I demonstrate how port scanning works using the popular tool NMAP. I dig into some theory on how NMAP can detect a port is open, show you how to detect a port scan in a Wireshark capture, then cover some ways to deter and obfuscate your services from scanning.

Useful links:

Support the channel:

Discord:

[RowanHawkins]

65, 535 is the total number of ports on any system. Ports below 1, 024 originally designated to be fixed services. With some very low ports being really basic things for an operating system to recognize echo(4) or character gen(7). The IETF originally designated those ports in an RFC. And originally you were supposed to register your application for one of those low bit ports if it was going to be a regular standard service on multiple systems. That idea kind of went up in flames mid-90s time frame because nobody paid any attention to it.

Ports above 1024 are Dynamic and are used by applications for whatever needs they have for additional ports freeing up the initial connection port for another device to connect to it.

As a funny note you use those low 3 bit ports to check if a system is alive when icmp is disabled/firewalled.

[TonoNamnum]

And it's 65535 because that's the maximum value you can fit in 2 bytes. In other words 2^16 = 65536. It's one less than that because port 0 is not used.

[prajwalsa]

I can use intrnet browsing also but
wifi networks not showing on to right plz help in laptop kali linuxx