In the context of the CompTIA PenTest+ curriculum, protocol scanning is a specialized active reconnaissance technique used during the enumeration phase to determine which IP protocols are supported by a target system. Unlike standard port scanning, which focuses on the Transport Layer (Layer 4) to …In the context of the CompTIA PenTest+ curriculum, protocol scanning is a specialized active reconnaissance technique used during the enumeration phase to determine which IP protocols are supported by a target system. Unlike standard port scanning, which focuses on the Transport Layer (Layer 4) to identify listening TCP or UDP services, protocol scanning operates at the Network Layer (Layer 3). It iterates through the 8-bit Protocol field found in the IP header, cycling through protocol numbers 0 to 255 to map the target's capabilities.
The primary tool utilized for this function is Nmap, specifically using the `-sO` switch. The scanning mechanism works by sending raw IP packets without additional protocol headers to the target host. The tester analyzes the responses to determine protocol status: if the target returns an ICMP Type 3, Code 2 message (Protocol Unreachable), the protocol is considered closed. If data is returned or no response is received (often due to firewall filtering), the protocol is classified as open or open|filtered.
For a penetration tester, this enumeration is critical for mapping the full attack surface. It reveals the existence of communication standards beyond TCP and UDP, such as ICMP (1), GRE (47), or ESP (50). Identifying these protocols can expose the presence of VPN tunnels, routing encapsulation, or IPsec implementations, potentially offering alternative vectors for attack or evasion. Furthermore, the specific set of supported protocols assists in Operating System (OS) fingerprinting, as different kernels implement protocol stacks differently. However, candidates should note that protocol scanning is intrusive and 'noisy,' making it highly likely to trigger Intrusion Detection Systems (IDS), thus requiring careful consideration during stealth engagements.
Mastering Protocol Scanning for CompTIA PenTest+
What is Protocol Scanning? Protocol scanning is a reconnaissance technique used to identify which IP protocols (such as TCP, UDP, ICMP, GRE, etc.) are supported by a target system. Unlike port scanning, which checks for open doors (ports) within TCP or UDP, Protocol Scanning iterates through the 8-bit Protocol field in the IPv4 header to determine which transport layer or other layer-3/4 protocols the host accepts.
Why is it Important? It is essential for mapping the attack surface beyond standard services. For instance, discovering that a server supports GRE (Protocol 47) or ESP (Protocol 50) might indicate it is a VPN endpoint. Knowing if ICMP (Protocol 1) is enabled or blocked helps in planning subsequent ping sweeps and OS fingerprinting attempts.
How it Works The scanner sends raw IP packets iterating through protocol numbers (0–255). The status is determined by the response: 1. Open: The target sends a response using that protocol. 2. Closed: The target returns an ICMP Type 3, Code 2 (Protocol Unreachable) message. 3. Filtered: No response is received (timeout), implying a firewall is dropping the traffic.
How to Answer Questions regarding Protocol Scanning In the exam, look for scenarios where the objective is to determine capabilities or supported communication types rather than specific applications like a web server or SSH. If a question presents an Nmap log showing the output -sO, identify this immediately as a Protocol Scan. If a question describes a tester sending packets with varying numbers in the IP header to identify VPN support, they are performing protocol scanning.
Exam Tips: Answering Questions on Protocol Scanning 1. The Nmap Switch: The critical switch to memorize is -sO (capital O). Do not confuse this with -O (Operating System detection) or -sP/-sn (Ping scan). 2. Protocol Numbers: Familiarize yourself with key IP protocol numbers: ICMP (1), TCP (6), UDP (17), GRE (47), and ESP (50). 3. ICMP Codes: Remember that ICMP Type 3, Code 2 explicitly refers to Protocol Unreachable. If you see this in a packet capture or log question, the protocol is closed on the target. 4. Stealth Consideration: Protocol scanning is very noisy and easily picked up by Intrusion Detection Systems (IDS). If an exam scenario requires a stealthy approach, protocol scanning is usually the wrong answer.