Network Scanning Countermeasures

Introduction
Network scanning is the second phase of the ethical hacking methodology, right after footprinting and reconnaissance. Attackers use it to discover live hosts, open ports, running services, operating systems and possible vulnerabilities. Network Scanning Countermeasures are the defensive controls, configurations and monitoring practices that stop, limit, detect or mislead these scanning attempts. In the CEH exam, you are expected to know both how scans work and how a defender can neutralize them.

Why Network Scanning Countermeasures Are Important
Scanning is the bridge between passive information gathering and active exploitation. If an attacker cannot build an accurate map of your network, every later phase (enumeration, vulnerability analysis, system hacking) becomes slower, noisier and more likely to be detected.
Key reasons these countermeasures matter:
- Reducing the attack surface: Every open port and exposed service is a potential entry point. Closing what is not needed removes targets.
- Early warning: Scans are often the first visible sign of an attack. Detecting them gives defenders time to respond.
- Hiding sensitive details: Preventing OS fingerprinting and banner grabbing stops attackers from matching your systems to known exploits.
- Compliance: Standards such as PCI DSS, HIPAA and ISO 27001 require firewall rules, logging, patching and intrusion detection.
- Cost of defense versus cost of breach: Blocking reconnaissance is far cheaper than recovering from a compromise.

What Network Scanning Countermeasures Are
They are a layered set of technical and administrative controls designed to counter the main scanning types:
- Host discovery (ICMP ping sweeps, ARP ping, TCP/UDP ping)
- Port and service scanning (TCP connect, SYN/half-open, FIN, NULL, Xmas, ACK, IDLE/IPID, UDP scans)
- OS discovery / fingerprinting (active with Nmap, passive with p0f)
- Banner grabbing (Telnet, Netcat, ID Serve, Netcraft)
- Evasion techniques (IP spoofing, packet fragmentation, source routing, decoys, proxies, anonymizers)

How They Work: Core Countermeasures

1. Port Scanning Countermeasures
- Configure firewall and IDS/IPS rules to detect and block probes, including stealth scans (SYN, FIN, NULL, Xmas).
- Run your own port scans (e.g., with Nmap) to verify that firewall rules are working as intended.
- Ensure routers, IDS and firewall firmware are updated to the latest releases.
- Close unused ports and disable unnecessary services and protocols.
- Block inbound ICMP traffic types that are not required, especially ICMP echo requests and ICMP type 3 (destination unreachable) messages leaving the network, so attackers gain little feedback.
- Filter traffic with ingress and egress filtering, and use a default deny rule set.
- Use stateful (dynamic) firewalls rather than simple packet filters, since stateful inspection catches out-of-state packets used in ACK, FIN, NULL and Xmas scans.
- Block or carefully restrict source routing and fragmented packets that try to slip past filters.
- Use port knocking or similar techniques to keep sensitive services hidden until a correct knock sequence is received.
- Deploy honeypots and tarpits (such as LaBrea) to slow and trap scanners.
- Apply rate limiting to reduce the speed and accuracy of mass scans.
- Ensure that the anti-scanning and anti-spoofing rules are applied on both internal and perimeter devices.

2. Ping Sweep / Host Discovery Countermeasures
- Configure firewalls to detect and block ping sweep traffic.
- Use IDS/IPS tools such as Snort to alert on ping sweep patterns.
- Evaluate ICMP traffic flowing into the enterprise and limit it to what operations truly require.
- Terminate connections from hosts that send more than a threshold of ICMP requests.
- Use DMZ designs and allow only necessary ICMP types (e.g., echo reply, destination unreachable, time exceeded) in specific zones.
- Limit ARP visibility through segmentation and VLANs to counter internal ARP ping scans.

3. OS Discovery / Fingerprinting Countermeasures
- Use firewalls and IDS to detect and block active fingerprinting probes.
- Alter or normalize TCP/IP stack values (TTL, window size, TCP options) so fingerprints are inaccurate; tools and kernel tweaks can do this.
- Use packet scrubbers / traffic normalizers to remove fingerprinting artifacts.
- Keep systems patched so that even if the OS is identified, known exploits fail.
- Disable or hide unnecessary services that reveal OS details.

4. Banner Grabbing Countermeasures
- Disable or change banners: show false or generic banners to mislead attackers (e.g., ServerMask, IIS Lockdown in older environments, modifying Apache ServerTokens and ServerSignature settings).
- Turn off unnecessary services to limit information disclosure.
- Hide file extensions (e.g., .asp, .php, .jsp) using URL rewriting, so the server technology is not revealed.
- Remove default pages and error messages that expose version information.
- Disable HTTP methods such as TRACE and OPTIONS when they are not needed.

5. IP Spoofing Detection and Countermeasures
Detection techniques:
- Direct TTL probing: send a packet to the claimed source and compare the TTL of the reply with the suspicious packet; a mismatch indicates spoofing.
- IP Identification Number (IPID): compare the IPID sequence of replies with that of the suspicious packet.
- TCP flow control method: spoofed senders do not receive the SYN-ACK, so they do not respect the receiver's window size; packets arriving after the window is exhausted suggest spoofing.
Countermeasures:
- Avoid trust relationships based solely on IP addresses.
- Use firewalls and filtering (ingress filtering per RFC 2827 / BCP 38 and egress filtering).
- Use random initial sequence numbers to prevent sequence prediction.
- Apply encryption (IPsec, TLS) and strong authentication.
- Implement SYN cookies and source address validation.

6. Countermeasures Against Evasion Techniques
- Reassemble fragmented packets on IDS/firewall before inspection.
- Block source-routed packets.
- Detect decoy scans by correlating logs across devices.
- Monitor and restrict traffic from known proxy and anonymizer networks (e.g., Tor exit nodes) where business policy allows.

7. Monitoring and Administrative Controls
- Centralized logging and SIEM correlation to spot scan patterns.
- Regular vulnerability assessments and internal scanning to find exposure before attackers do.
- Network segmentation and least privilege for network access.
- Patch management and configuration baselines (hardening guides such as CIS Benchmarks).
- Security awareness and documented incident response procedures for detected scans.

Mapping Scans to Countermeasures (Quick Reference)
- ICMP ping sweep → block/limit ICMP echo, IDS alerts
- SYN (half-open) scan → stateful firewall, IDS signatures, SYN rate limiting
- FIN/NULL/Xmas scans → stateful inspection drops out-of-state packets; note that Windows hosts respond with RST anyway, making these scans less reliable
- ACK scan (firewall mapping) → stateful firewall
- IDLE/IPID scan → use OSes with random IPID values, block spoofed packets with ingress filtering
- UDP scan → close unused UDP services, rate-limit ICMP port unreachable replies
- OS fingerprinting → stack normalization, scrubbers, IDS
- Banner grabbing → banner modification, hide extensions, disable services
- IP spoofing → ingress/egress filtering, TTL/IPID checks, encryption

Exam Tips: Answering Questions on Network Scanning Countermeasures
1. Identify the scan type first. Read the scenario and determine whether it describes host discovery, port scanning, OS fingerprinting, banner grabbing or spoofing. The right countermeasure depends on the scan type.
2. Prefer the most specific and effective control. If a question asks how to stop banner grabbing, answers like display false banners or disable unnecessary services beat generic answers like install antivirus.
3. Stateful beats stateless. When asked which device best stops ACK, FIN, NULL or Xmas scans, choose the stateful firewall over a simple packet filter.
4. Know the IP spoofing detection trio: Direct TTL probes, IP Identification Number and TCP Flow Control Method. Questions often describe one and ask you to name it.
5. Remember ingress filtering against spoofing. Blocking packets entering your network with internal source addresses is the classic anti-spoofing measure; egress filtering stops your network being used as a spoofing source.
6. ICMP blocking questions: Blocking ICMP echo requests at the perimeter is the standard answer for ping sweep defense. Remember that attackers can still use TCP/UDP or ARP pings, so layered defenses are expected.
7. Watch for distractor answers. Options like encrypting the hard drive or using strong passwords are good practices but do not counter scanning. Choose the control tied to the network layer activity described.
8. Hiding file extensions is a common banner grabbing / web server fingerprinting countermeasure answer.
9. Honeypots and tarpits appear as answers for detecting or slowing scanners; LaBrea is the classic tarpit example.
10. Testing your own defenses is a valid countermeasure: CEH lists running your own port scans to verify firewall configuration.
11. Least privilege for services: If a question asks for the first or best step, closing unused ports and disabling unneeded services is usually the foundational answer.
12. Pay attention to keywords like best, most effective, first and detect versus prevent. IDS detects, IPS and firewalls prevent, honeypots deceive.
13. Random IPID and random sequence numbers defend against IDLE scans and TCP session hijacking/sequence prediction respectively.
14. Eliminate absolute answers such as block all traffic, since they break business functionality and are rarely correct.

Sample Question Walkthrough
Question: An administrator notices packets arriving at the perimeter with source addresses belonging to the internal network. What is the best countermeasure?
Reasoning: Internal source addresses arriving from outside indicate IP spoofing. The control that drops such packets at the edge is ingress filtering.
Answer: Implement ingress filtering on the border router/firewall.

Question: Which technique detects spoofed packets by comparing the hop count of a reply from the claimed source with the hop count of the suspicious packet?
Answer: Direct TTL probing.

Summary
Network Scanning Countermeasures form a layered defense: reduce exposure (close ports, disable services, patch), filter intelligently (stateful firewalls, ICMP limits, ingress/egress filtering), conceal identity (banner modification, stack normalization, hidden extensions), detect activity (IDS/IPS, SIEM, honeypots) and validate defenses (self-scanning, audits). For the CEH exam, always match the scan described in the scenario to the most targeted countermeasure, and watch carefully for detect versus prevent wording.