ProRT-IP WarScan

Protocol/Port Real-Time War Scanner for IP Networks

Modern network scanner combining Masscan/ZMap speed with Nmap detection depth.

What is ProRT-IP?

ProRT-IP WarScan (Protocol/Port Real-Time IP War Scanner) is a modern equivalent of classic 1980s/1990s war dialers—reimagined for IP networks. Where tools like ToneLoc and THC-Scan systematically dialed phone numbers to find modems/BBSs, WarScan systematically scans IP address ranges, ports, and protocols to discover active hosts and services.

WarScan consolidates and advances the best of today's network scanning and analysis tools, delivering a comprehensive, high-performance, stealth-focused toolkit for penetration testers and red teams.

Key Features

• Speed: 10M+ packets/second stateless scanning (comparable to Masscan/ZMap)
• Depth: Comprehensive service detection and OS fingerprinting (like Nmap)
• Safety: Memory-safe Rust implementation prevents entire vulnerability classes
• Stealth: Advanced evasion techniques (timing, decoys, fragmentation, TTL manipulation, idle scans)
• Modern TUI: Real-time dashboard with 60 FPS rendering, 4-tab interface, 8 production widgets
• Extensibility: Plugin system with Lua 5.4 sandboxed execution

At a Glance

• Multi-Protocol Scanning: TCP (SYN, Connect, FIN, NULL, Xmas, ACK, Idle/Zombie), UDP, ICMP/ICMPv6, NDP
• IPv6 Support: ✅ Complete IPv6 support (all 8 scanners) - Full dual-stack implementation
• Service Detection: 187 embedded protocol probes + 5 protocol-specific parsers (HTTP, SSH, SMB, MySQL, PostgreSQL) + SSL/TLS handshake (85-90% detection rate)
• OS Fingerprinting: 2,600+ signatures using 16-probe technique
• Evasion Techniques: IP fragmentation (-f, --mtu), TTL manipulation (--ttl), bad checksums (--badsum), decoy scanning (-D RND:N), idle/zombie scan (-sI)
• High Performance: Asynchronous I/O with lock-free coordination, zero-copy packet building, adaptive rate limiting (-1.8% overhead)
• Cross-Platform: Linux, Windows, macOS, FreeBSD support with NUMA optimization
• Multiple Interfaces: CLI (production-ready), TUI (60 FPS real-time dashboard), Web UI (planned), GUI (planned)

Quick Start

# Download latest release
wget https://github.com/doublegate/ProRT-IP/releases/latest/download/prtip-linux-x86_64
chmod +x prtip-linux-x86_64
sudo mv prtip-linux-x86_64 /usr/local/bin/prtip

# SYN scan (requires privileges)
prtip -sS -p 80,443 192.168.1.0/24

# Fast scan (top 100 ports)
prtip -F 192.168.1.1

# Service detection
prtip -sV -p 1-1000 scanme.nmap.org

# TUI mode with real-time dashboard
prtip --tui -sS -p 1-1000 192.168.1.0/24

Documentation Navigation

New Users

• Installation & Setup - Get started in 5 minutes
• Quick Start Guide - Your first scan
• Tutorial: Your First Scan - Step-by-step walkthrough

Experienced Users

• User Guide - Comprehensive usage documentation
• Scan Types - TCP, UDP, stealth scans
• Nmap Compatibility - Drop-in nmap replacement

Advanced Topics

• Performance Tuning - Optimize for speed
• TUI Architecture - Real-time dashboard internals
• Plugin System - Extend ProRT-IP with Lua

Developers

• Architecture Overview - System design
• Contributing Guidelines - How to contribute
• Testing Strategy - Quality assurance

Current Status

Version: v0.5.2 (Released 2025-11-14) Phase: 6 Sprint 6.3 PARTIAL (3/8 sprints, 38%) Tests: 2,111 passing (100%) Coverage: 54.92%

Recent Achievements

Sprint 6.2 COMPLETE (2025-11-14): Live Dashboard & Real-Time Metrics

• 4-tab dashboard interface (Port Table, Service Table, Metrics, Network Graph)
• Real-time port discovery and service detection visualization
• Performance metrics with 5-second rolling averages
• Network activity time-series chart (60-second sliding window)
• 175 tests passing (150 unit + 25 integration)

Sprint 6.3 PARTIAL (3/6 task areas):

• CDN IP Deduplication (30-70% target reduction)
• Adaptive Batch Sizing (20-40% throughput improvement)
• Integration Testing (comprehensive test coverage)

Links

• GitHub: https://github.com/doublegate/ProRT-IP
• Issues: https://github.com/doublegate/ProRT-IP/issues
• Security: https://github.com/doublegate/ProRT-IP/security/advisories
• Changelog: ../../CHANGELOG.md

License

This project is licensed under the GNU General Public License v3.0.

GPLv3 allows you to:

• ✅ Use the software for any purpose
• ✅ Study and modify the source code
• ✅ Distribute copies
• ✅ Distribute modified versions

Under the conditions:

• ⚠️ Disclose source code of modifications
• ⚠️ License modifications under GPLv3
• ⚠️ State changes made to the code
• ⚠️ Include copyright and license notices

⚠️ IMPORTANT: Only scan networks you own or have explicit written permission to test. Unauthorized scanning may violate laws (CFAA, CMA, etc.).

Last Updated: 2025-11-16

ProRT-IP WarScan: Development Setup Guide

Version: 1.0 Last Updated: 2025-11-16

Table of Contents

1. Prerequisites
2. Platform-Specific Setup
3. Building the Project
4. Development Tools
5. Testing Environment
6. IDE Configuration
7. Troubleshooting

Prerequisites

Required Software

Rust Toolchain (1.85+)

# Install rustup (cross-platform Rust installer)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

# Configure current shell
source $HOME/.cargo/env

# Verify installation
rustc --version  # Should be 1.85.0 or higher
cargo --version

Git

# Linux (Debian/Ubuntu)
sudo apt install git

# Linux (Fedora)
sudo dnf install git

# macOS
brew install git

# Windows
# Download from https://git-scm.com/download/win

System Libraries

Network programming requires platform-specific libraries for raw packet access.

Platform-Specific Setup

Linux

Debian/Ubuntu

# Update package lists
sudo apt update

# Install development tools
sudo apt install -y \
    build-essential \
    pkg-config \
    libpcap-dev \
    libssl-dev \
    cmake

# Optional: Install setcap for capability management
sudo apt install -y libcap2-bin

# Optional: Performance profiling tools
sudo apt install -y \
    linux-tools-generic \
    linux-tools-$(uname -r) \
    valgrind

Fedora/RHEL

# Install development tools
sudo dnf groupinstall "Development Tools"

# Install libraries
sudo dnf install -y \
    libpcap-devel \
    openssl-devel \
    cmake

# Optional: Performance tools
sudo dnf install -y \
    perf \
    valgrind

Arch Linux

# Install dependencies
sudo pacman -S \
    base-devel \
    libpcap \
    openssl \
    cmake

# Optional: Performance tools
sudo pacman -S \
    perf \
    valgrind

Capabilities Setup (Recommended)

Instead of running as root, grant specific capabilities:

# After building the project
sudo setcap cap_net_raw,cap_net_admin=eip target/release/prtip

# Verify capabilities
getcap target/release/prtip
# Output: target/release/prtip = cap_net_admin,cap_net_raw+eip

Windows

Prerequisites

1. Visual Studio Build Tools

   • Download from: https://visualstudio.microsoft.com/downloads/
   • Install "Desktop development with C++"
   • Include: MSVC compiler, Windows SDK

2. Npcap

   # Download Npcap installer from:
   # https://npcap.com/dist/npcap (latest version)
   
   # Install with options:
   # - [x] Install Npcap in WinPcap API-compatible mode
   # - [x] Support raw 802.11 traffic
   

3. Npcap SDK

   # Download SDK from:
   # https://npcap.com/dist/npcap-sdk-1.13.zip
   
   # Extract to: C:\npcap-sdk
   
   # Set environment variable
   setx NPCAP_SDK "C:\npcap-sdk"
   

OpenSSL (for SSL/TLS service detection)

# Using vcpkg (recommended)
git clone https://github.com/Microsoft/vcpkg.git
cd vcpkg
.\bootstrap-vcpkg.bat
.\vcpkg integrate install
.\vcpkg install openssl:x64-windows

# Or download pre-built binaries:
# https://slproweb.com/products/Win32OpenSSL.html

Build Configuration

Create .cargo/config.toml:

[target.x86_64-pc-windows-msvc]
rustflags = [
    "-C", "link-arg=/LIBPATH:C:\\npcap-sdk\\Lib\\x64",
]

[build]
target = "x86_64-pc-windows-msvc"

macOS

Install Xcode Command Line Tools

xcode-select --install

Install Homebrew (if not already installed)

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Install Dependencies

# libpcap (usually pre-installed, but install latest)
brew install libpcap

# OpenSSL
brew install openssl@3

# Link OpenSSL for pkg-config
echo 'export PKG_CONFIG_PATH="/usr/local/opt/openssl@3/lib/pkgconfig"' >> ~/.zshrc
source ~/.zshrc

Setup BPF Device Permissions

# Create access_bpf group (if not exists)
sudo dscl . -create /Groups/access_bpf
sudo dscl . -create /Groups/access_bpf PrimaryGroupID 1001
sudo dscl . -create /Groups/access_bpf GroupMembership $(whoami)

# Install ChmodBPF script
curl -O https://raw.githubusercontent.com/wireshark/wireshark/master/packaging/macosx/ChmodBPF/ChmodBPF
sudo mv ChmodBPF /Library/StartupItems/
sudo chmod +x /Library/StartupItems/ChmodBPF/ChmodBPF

# Or use Wireshark's installer which includes ChmodBPF
brew install --cask wireshark

Building the Project

Clone Repository

git clone https://github.com/doublegate/ProRT-IP.git
cd prtip-warscan

Project Structure

prtip-warscan/
├── Cargo.toml           # Workspace manifest
├── Cargo.lock           # Dependency lock file
├── src/                 # Main source code (future)
├── crates/              # Workspace crates (future)
│   ├── core/            # Core scanning engine
│   ├── net/             # Network protocol implementation
│   ├── detect/          # OS/service detection
│   ├── plugins/         # Plugin system
│   └── ui/              # User interfaces (CLI, TUI)
├── tests/               # Integration tests
├── benches/             # Performance benchmarks
├── docs/                # Documentation
└── scripts/             # Build and development scripts

Build Commands

Development Build

# Build with debug symbols and optimizations disabled
cargo build

# Binary location: target/debug/prtip

Release Build

# Build with full optimizations
cargo build --release

# Binary location: target/release/prtip

Build with Specific Features

# Build without Lua plugin support
cargo build --release --no-default-features

# Build with all optional features
cargo build --release --all-features

# Build with specific features
cargo build --release --features "lua-plugins,python-plugins"

Cross-Compilation

# Install cross-compilation target
rustup target add x86_64-unknown-linux-musl

# Build for musl (static linking)
cargo build --release --target x86_64-unknown-linux-musl

Development Tools

Recommended Cargo Extensions

# Code formatting
cargo install cargo-fmt
rustup component add rustfmt

# Linting
rustup component add clippy

# Security auditing
cargo install cargo-audit

# Test coverage
cargo install cargo-tarpaulin  # Linux only

# Benchmarking
cargo install cargo-criterion

# Dependency tree visualization
cargo install cargo-tree

# License checking
cargo install cargo-license

# Bloat analysis
cargo install cargo-bloat

# Unused dependency detection
cargo install cargo-udeps

Code Quality Checks

Format Code

# Check formatting (CI mode)
cargo fmt --check

# Auto-format all code
cargo fmt

Lint Code

# Run clippy with pedantic warnings
cargo clippy -- -D warnings -W clippy::pedantic

# Fix automatically where possible
cargo clippy --fix

Security Audit

# Check for known vulnerabilities in dependencies
cargo audit

# Update advisory database
cargo audit fetch

Performance Profiling

Linux: perf + flamegraph

# Build with debug symbols in release mode
RUSTFLAGS="-C debuginfo=2 -C force-frame-pointers=yes" cargo build --release

# Record performance data
sudo perf record --call-graph dwarf -F 997 ./target/release/prtip [args]

# Generate flamegraph
perf script | stackcollapse-perf.pl | flamegraph.pl > flame.svg

# View in browser
firefox flame.svg

Cross-Platform: Criterion Benchmarks

# Run benchmarks
cargo bench

# View HTML report
firefox target/criterion/report/index.html

Memory Profiling (Linux)

# Check for memory leaks
valgrind --leak-check=full --show-leak-kinds=all ./target/debug/prtip [args]

# Heap profiling with massif
valgrind --tool=massif ./target/debug/prtip [args]
ms_print massif.out.12345 > massif.txt

Testing Environment

Unit Tests

# Run all tests
cargo test

# Run specific test
cargo test test_tcp_checksum

# Run tests with output
cargo test -- --nocapture

# Run tests in single thread (useful for network tests)
cargo test -- --test-threads=1

Integration Tests

# Run only integration tests
cargo test --test integration_tests

# Run with logging
RUST_LOG=debug cargo test

Test Coverage

# Linux only (requires cargo-tarpaulin)
cargo tarpaulin --out Html --output-dir coverage

# View report
firefox coverage/index.html

Test Network Setup

Create Isolated Test Environment

# Linux: Create network namespace for testing
sudo ip netns add prtip-test
sudo ip netns exec prtip-test bash

# Inside namespace, setup loopback
ip link set lo up

# Run tests in isolated namespace
cargo test

Docker Test Environment

# Build test container
docker build -t prtip-test -f Dockerfile.test .

# Run tests in container
docker run --rm -it prtip-test cargo test

IDE Configuration

Visual Studio Code

Recommended Extensions

• rust-lang.rust-analyzer - Rust language server
• vadimcn.vscode-lldb - Native debugger
• serayuzgur.crates - Dependency version management
• tamasfe.even-better-toml - TOML syntax support

.vscode/settings.json

{
  "rust-analyzer.checkOnSave.command": "clippy",
  "rust-analyzer.cargo.features": "all",
  "editor.formatOnSave": true,
  "editor.rulers": [100],
  "[rust]": {
    "editor.defaultFormatter": "rust-lang.rust-analyzer"
  }
}

.vscode/launch.json

{
  "version": "0.2.0",
  "configurations": [
    {
      "type": "lldb",
      "request": "launch",
      "name": "Debug prtip",
      "cargo": {
        "args": ["build", "--bin=prtip"],
        "filter": {
          "name": "prtip",
          "kind": "bin"
        }
      },
      "args": ["-sS", "-p", "80,443", "192.168.1.0/24"],
      "cwd": "${workspaceFolder}",
      "preLaunchTask": "cargo-build"
    }
  ]
}

IntelliJ IDEA / CLion

Install Rust Plugin

• File → Settings → Plugins → Search "Rust" → Install

Project Configuration

• Open Cargo.toml as project
• Enable "Use rustfmt instead of built-in formatter"
• Set "External linter" to Clippy
• Configure run configurations for different scan types

Vim/Neovim

Using coc.nvim

" Install coc-rust-analyzer
:CocInstall coc-rust-analyzer

" Add to .vimrc or init.vim
autocmd FileType rust set colorcolumn=100
autocmd FileType rust set expandtab shiftwidth=4 softtabstop=4

Troubleshooting

Common Build Issues

"libpcap not found"

Linux:

sudo apt install libpcap-dev  # Debian/Ubuntu
sudo dnf install libpcap-devel  # Fedora

macOS:

brew install libpcap
export PKG_CONFIG_PATH="/usr/local/lib/pkgconfig"

Windows:

Ensure Npcap SDK is installed and NPCAP_SDK environment variable is set

"OpenSSL not found"

Linux:

sudo apt install libssl-dev pkg-config

macOS:

brew install openssl@3
export PKG_CONFIG_PATH="/usr/local/opt/openssl@3/lib/pkgconfig"

Windows:

# Install OpenSSL via vcpkg or download binaries
# Set OPENSSL_DIR environment variable
setx OPENSSL_DIR "C:\Program Files\OpenSSL-Win64"

"Permission denied" on packet capture

Linux:

# Option 1: Use capabilities (recommended)
sudo setcap cap_net_raw,cap_net_admin=eip target/release/prtip

# Option 2: Run as root (not recommended for development)
sudo ./target/release/prtip [args]

macOS:

# Ensure you're in access_bpf group
groups | grep access_bpf

# If not, add yourself (requires logout/login)
sudo dseditgroup -o edit -a $(whoami) -t user access_bpf

Windows:

Run terminal as Administrator

Linker errors on Windows

# Ensure Visual Studio Build Tools are installed with C++ support
# Install Windows SDK 10

# Check environment variables
echo %LIB%
echo %INCLUDE%

Runtime Issues

"Cannot create raw socket"

This usually indicates insufficient privileges. See solutions in "Permission denied" section above.

High CPU usage during compilation

# Limit parallel compilation jobs
cargo build -j 2

# Or set permanently in ~/.cargo/config.toml
[build]
jobs = 2

Out of memory during linking

# Use lld for faster linking with less memory
rustup component add lld

# Add to .cargo/config.toml
[target.x86_64-unknown-linux-gnu]
rustflags = ["-C", "link-arg=-fuse-ld=lld"]

Testing Issues

Tests failing with "Address already in use"

# Run tests serially instead of parallel
cargo test -- --test-threads=1

Tests timing out on slow networks

# Increase test timeout
cargo test -- --test-timeout=300

Environment Variables

Build-Time Variables

# Set Rust backtrace for debugging
export RUST_BACKTRACE=1          # Short backtrace
export RUST_BACKTRACE=full       # Full backtrace

# Logging during build
export RUST_LOG=debug

# Compilation flags
export RUSTFLAGS="-C target-cpu=native"  # Optimize for current CPU

Runtime Variables

# Logging verbosity
export RUST_LOG=prtip=debug,tower=info

# Custom config file location
export PRTIP_CONFIG=/etc/prtip/config.toml

# Override default database path
export PRTIP_DB_PATH=/var/lib/prtip/scans.db

Continuous Integration

The project uses GitHub Actions for CI/CD with automated testing and release management.

CI Workflows

ci.yml - Continuous Integration:

• Format check: cargo fmt --check
• Clippy lint: cargo clippy -- -D warnings
• Multi-platform testing: Linux, Windows, macOS
• Security audit: cargo audit
• MSRV verification: Rust 1.82+

release.yml - Release Automation:

• Triggers on git tags: v*.*.*
• Multi-platform binary builds:
  • x86_64-unknown-linux-gnu (glibc)
  • x86_64-unknown-linux-musl (static)
  • x86_64-pc-windows-msvc (Windows)
  • x86_64-apple-darwin (macOS)
• Automatic GitHub release creation
• Binary artifacts upload

dependency-review.yml - PR Security:

• Scans for vulnerable dependencies
• Detects malicious packages
• Automated on all pull requests

codeql.yml - Security Analysis:

• Advanced security scanning with CodeQL
• Weekly scheduled runs
• SARIF upload to GitHub Security tab

Local Testing

Test formatting/linting before pushing to save CI time:

# Check formatting
cargo fmt --all -- --check

# Run clippy (strict mode)
cargo clippy --workspace --all-targets -- -D warnings

# Run tests
cargo test --workspace

# Build release
cargo build --release --workspace

# Security audit
cargo install cargo-audit
cargo audit

CI Optimization

The CI pipeline uses aggressive 3-tier caching:

1. Cargo registry (~100-500 MB): Downloaded crate metadata
2. Cargo index (~50-200 MB): Git index for crates.io
3. Build cache (~500 MB - 2 GB): Compiled dependencies

Performance benefits:

• Clean build: 5-10 minutes
• Cached build: 1-2 minutes (80-90% speedup)
• Cache hit rate: ~80-90% for typical changes

Workflow Status

Check workflow runs: GitHub Actions

Status badges (add to README):

[![CI](https://github.com/doublegate/ProRT-IP/actions/workflows/ci.yml/badge.svg)](https://github.com/doublegate/ProRT-IP/actions/workflows/ci.yml)
[![Release](https://github.com/doublegate/ProRT-IP/actions/workflows/release.yml/badge.svg)](https://github.com/doublegate/ProRT-IP/actions/workflows/release.yml)

Next Steps

After completing setup:

1. Build the project: cargo build --release
2. Run tests: cargo test
3. Review Architecture Overview
4. Check Technical Specifications for implementation details
5. Begin development following Roadmap
6. Review CI/CD Workflows (see .github/workflows/ directory) for automation details

Getting Help

• Documentation: See docs/ directory
• Issues: GitHub Issues for bug reports
• Discussions: GitHub Discussions for questions
• CI/CD: See .github/workflows/ directory for workflow documentation
• Chat: Join project Discord/Matrix (TBD)

Quick Start Guide

Get started with ProRT-IP WarScan in 5 minutes.

Installation

Option 1: Binary Download (Fastest)

# Download latest release
wget https://github.com/doublegate/ProRT-IP/releases/latest/download/prtip-linux-x86_64
chmod +x prtip-linux-x86_64
sudo mv prtip-linux-x86_64 /usr/local/bin/prtip

# Verify installation
prtip --version

Expected Output:

ProRT-IP v0.5.2

Option 2: Build from Source

# Install Rust (if not already installed)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

# Clone and build
git clone https://github.com/doublegate/ProRT-IP.git
cd ProRT-IP
cargo build --release

# Install binary
sudo cp target/release/prtip /usr/local/bin/

# Verify
prtip --version

See Installation Guide for platform-specific details.

Your First Scan

Scan a Single Host

The most basic scan - check if common web ports are open:

prtip -sS -p 80,443 scanme.nmap.org

Explanation:

• -sS: TCP SYN scan (fast, stealthy, requires root)
• -p 80,443: Scan ports 80 (HTTP) and 443 (HTTPS)
• scanme.nmap.org: Nmap's official test target

Expected Output:

[✓] Starting TCP SYN scan of scanme.nmap.org (45.33.32.156)
[✓] Scanning 2 ports (80, 443)

PORT    STATE   SERVICE
80/tcp  open    http
443/tcp open    https

[✓] Scan complete: 2 ports scanned, 2 open (100.00%)
[✓] Duration: 1.23s

Understanding the Output:

• PORT: Port number and protocol (tcp/udp)
• STATE: Port status (open/closed/filtered)
• SERVICE: Common service name for that port

Common Scanning Tasks

Task 1: Fast Scan (Top 100 Ports)

Quickly check the most commonly used ports:

prtip -F scanme.nmap.org

Explanation:

• -F: Fast mode (scans top 100 most common ports)
• Completes in 2-5 seconds
• Covers 90% of real-world services

When to Use:

• Initial reconnaissance
• Quick network checks
• Time-constrained situations

Task 2: Scan Your Local Network

Discover what's on your home/office network:

sudo prtip -sS -p 1-1000 192.168.1.0/24

Explanation:

• 192.168.1.0/24: Scans all IPs from 192.168.1.1 to 192.168.1.254 (256 hosts)
• -p 1-1000: First 1000 ports (well-known and registered ports)
• Replace 192.168.1.0/24 with your actual network range

Find Your Network Range:

# Linux/macOS
ip addr show | grep inet
# or
ifconfig | grep inet

# Windows
ipconfig

Expected Duration: 2-10 minutes depending on live hosts

Task 3: Service Version Detection

Identify what software is running on open ports:

sudo prtip -sV -p 22,80,443 scanme.nmap.org

Explanation:

• -sV: Enable service version detection
• Probes open ports to identify software name and version
• Takes longer (15-30 seconds per port) but provides valuable intelligence

Example Output:

PORT    STATE   SERVICE  VERSION
22/tcp  open    ssh      OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13
80/tcp  open    http     Apache httpd 2.4.7
443/tcp open    ssl/http Apache httpd 2.4.7

Why This Matters:

• Identify outdated software with known vulnerabilities
• Understand your attack surface
• Compliance requirements (know what's running on your network)

Task 4: Save Results to File

Save scan results for later analysis:

sudo prtip -sS -p 1-1000 192.168.1.0/24 -oN scan-results.txt

Output Format Options:

# Normal output (human-readable)
prtip -sS -p 80,443 TARGET -oN results.txt

# XML output (machine-parseable, Nmap-compatible)
prtip -sS -p 80,443 TARGET -oX results.xml

# JSON output (modern APIs)
prtip -sS -p 80,443 TARGET -oJ results.json

# Greppable output (one-line per host)
prtip -sS -p 80,443 TARGET -oG results.grep

# All formats at once
prtip -sS -p 80,443 TARGET -oA results
# Creates: results.txt, results.xml, results.json, results.grep

Understanding Scan Types

SYN Scan (Default) - Fast & Stealthy

sudo prtip -sS -p 80,443 TARGET

How it Works:

1. Sends SYN packet (TCP handshake step 1)
2. Target responds with SYN-ACK if port is open
3. Scanner sends RST (doesn't complete handshake)

Advantages:

• Fast (doesn't complete full connection)
• Stealthy (half-open connection may not be logged)
• 95% accuracy

Disadvantages:

• Requires root/admin privileges
• Some firewalls detect SYN scans

When to Use: Default choice for most scanning scenarios (95% of use cases)

Connect Scan - No Privileges Required

prtip -sT -p 80,443 TARGET

How it Works:

1. Completes full TCP three-way handshake
2. Establishes real connection
3. Immediately closes connection

Advantages:

• Works without root/admin privileges
• 99% accuracy (real connection test)
• Works on any platform

Disadvantages:

• Slower than SYN scan
• Always logged by target
• More easily detected

When to Use:

• You don't have root access
• Need 100% accuracy
• Testing application-layer availability

UDP Scan - Services That Don't Use TCP

sudo prtip -sU -p 53,161,123 TARGET

Common UDP Services:

• Port 53: DNS
• Port 161: SNMP
• Port 123: NTP
• Port 514: Syslog
• Port 67/68: DHCP

How it Works:

1. Sends UDP packet to target port
2. Waits for response or ICMP Port Unreachable
3. No response = open|filtered (uncertain)

Advantages:

• Discovers UDP services
• Many critical services use UDP

Disadvantages:

• Very slow (10-100x slower than TCP)
• Less accurate (80% vs 95% for TCP)
• Requires root privileges

When to Use:

• Need complete network inventory
• Scanning DNS, SNMP, or other UDP services
• Compliance requirements

Expected Duration: 30-60 seconds for 3 ports (vs 1-2 seconds for TCP)

Scanning Best Practices

1. Start with Host Discovery

Before scanning ports, discover which hosts are alive:

# Host discovery (no port scan)
sudo prtip -sn 192.168.1.0/24 -oN live-hosts.txt

# Review live hosts
cat live-hosts.txt

# Then scan only live hosts
sudo prtip -sS -p 1-1000 -iL live-hosts.txt

Time Savings:

• If 20 out of 256 hosts are live: 92% faster (scan 20 instead of 256)
• Reduces network noise

2. Use Appropriate Timing

Balance speed vs detection risk:

# Paranoid (T0) - 5 minutes between probes
sudo prtip -sS -T0 -p 80,443 TARGET

# Sneaky (T1) - 15 seconds between probes
sudo prtip -sS -T1 -p 80,443 TARGET

# Polite (T2) - 0.4 seconds between probes
sudo prtip -sS -T2 -p 80,443 TARGET

# Normal (T3) - Default, balanced
sudo prtip -sS -p 80,443 TARGET

# Aggressive (T4) - Fast local scanning
sudo prtip -sS -T4 -p 80,443 TARGET

# Insane (T5) - Maximum speed (may miss results)
sudo prtip -sS -T5 -p 80,443 TARGET

Recommendations:

• Local networks: T4 (Aggressive)
• Production systems: T2 (Polite)
• Internet targets: T3 (Normal)
• IDS evasion: T0 or T1
• Quick testing: T5 (Insane)

3. Limit Scan Scope

Scan only what you need:

# Scan specific ports
prtip -sS -p 22,80,443,3389 TARGET

# Scan port range
prtip -sS -p 1-1000 TARGET

# Scan all ports (warning: very slow)
prtip -sS -p 1-65535 TARGET  # or -p-

Port Selection Tips:

• Web services: 80, 443, 8080, 8443
• Remote access: 22 (SSH), 3389 (RDP), 23 (Telnet)
• Databases: 3306 (MySQL), 5432 (PostgreSQL), 1433 (MSSQL)
• Mail: 25 (SMTP), 110 (POP3), 143 (IMAP), 587 (SMTP TLS)
• File sharing: 445 (SMB), 21 (FTP), 22 (SFTP)

4. Get Permission First

Legal Requirements:

• ✅ Scan your own networks
• ✅ Scan with explicit written permission
• ✅ Use authorized test targets (e.g., scanme.nmap.org)
• ❌ NEVER scan without permission (violates CFAA, CMA, and similar laws)

Authorized Test Targets:

• scanme.nmap.org - Nmap's official test server
• Your own machines/networks
• Penetration testing labs (HackTheBox, TryHackMe)
• Explicitly authorized targets during engagements

Real-World Examples

Example 1: Home Network Audit

Objective: Identify all devices and services on your home network

# Step 1: Find your network range
ip addr show | grep "inet 192.168"
# Example output: inet 192.168.1.100/24

# Step 2: Discover live hosts
sudo prtip -sn 192.168.1.0/24 -oN home-hosts.txt

# Step 3: Fast scan of live hosts
sudo prtip -F -iL home-hosts.txt -oN home-services.txt

# Step 4: Review results
cat home-services.txt

What You'll Find:

• Router: Ports 80, 443 (web interface)
• Smart devices: Various ports
• Computers: 22 (SSH), 3389 (RDP), 445 (SMB)
• Printers: 9100, 631

Example 2: Web Server Health Check

Objective: Verify web server is running and identify version

# Quick check
prtip -sS -p 80,443 www.example.com

# Detailed check with service detection
sudo prtip -sV -p 80,443,8080,8443 www.example.com

# With TLS certificate info
sudo prtip -sV -p 443 --script=ssl-cert www.example.com

What You'll Learn:

• Which ports are open (80, 443, etc.)
• Web server type and version (Apache, Nginx, IIS)
• TLS certificate details (expiration, issuer)

Example 3: Database Server Security Audit

Objective: Check database server exposure

# Scan common database ports
sudo prtip -sV -p 3306,5432,1433,27017 db-server.example.com

# If any are open, investigate further
sudo prtip -sV -p 3306 --script=mysql-info db-server.example.com

Security Checklist:

• ✅ Databases should NOT be exposed to internet
• ✅ Should only be accessible from application servers
• ✅ Should use authentication
• ✅ Should use TLS encryption

Example 4: New Device Discovery

Objective: Find new devices that appeared on network

# Initial baseline scan
sudo prtip -sn 192.168.1.0/24 -oN baseline.txt

# Wait (hours/days)

# Current scan
sudo prtip -sn 192.168.1.0/24 -oN current.txt

# Compare
diff baseline.txt current.txt

Use Cases:

• Detect rogue devices
• Identify new IoT devices
• Network change tracking
• Security monitoring

Common Command Patterns

Pattern 1: Quick Web Service Check

prtip -sS -p 80,443 TARGET

Use Case: Verify web server is running

Pattern 2: Comprehensive Single Host Scan

sudo prtip -sS -sV -p 1-10000 TARGET -oA host-scan

Use Case: Complete security audit of a specific server

Pattern 3: Network Discovery

sudo prtip -sn 192.168.1.0/24

Use Case: Find all active devices on network

Pattern 4: Service Version Audit

sudo prtip -sV -p 22,80,443,3389 192.168.1.0/24 -oJ services.json

Use Case: Inventory all service versions on network

Pattern 5: Fast Network Scan

sudo prtip -F -T4 192.168.1.0/24

Use Case: Quick network reconnaissance (2-5 minutes)

Pattern 6: Stealth Scan

sudo prtip -sF -T1 -D RND:10 -p 80,443 TARGET

Use Case: Evade detection while scanning

Interpreting Results

Port States

open

• Service is actively accepting connections
• Most interesting for penetration testing
• Indicates running service

closed

• Port is accessible but no service running
• Responds with RST packet
• Less interesting but shows host is reachable

filtered

• Firewall or packet filter blocking access
• No response received
• Common on internet-facing hosts

open|filtered

• Cannot determine if open or filtered
• Common with UDP scans
• May need additional probing

Example Scan Result Analysis

PORT     STATE   SERVICE     VERSION
22/tcp   open    ssh         OpenSSH 6.6.1p1 Ubuntu
80/tcp   open    http        Apache httpd 2.4.7
443/tcp  open    ssl/http    Apache httpd 2.4.7
3306/tcp closed  mysql
8080/tcp filtered http-proxy

Analysis:

• Port 22 (SSH): OpenSSH 6.6.1p1 - OUTDATED (2014, known vulnerabilities)
• Port 80/443 (HTTP/HTTPS): Apache 2.4.7 - OUTDATED (2013, multiple CVEs)
• Port 3306 (MySQL): Closed - Good (not exposed)
• Port 8080: Filtered - May be behind firewall

Action Items:

1. Update OpenSSH to version 8.0+ immediately
2. Update Apache to 2.4.41+ (current stable)
3. Investigate port 8080 filtering rules
4. Consider disabling SSH password authentication (use keys)

Next Steps

Now that you've completed your first scans:

1. Deep Dive: Tutorials - 7 comprehensive tutorials from beginner to expert
2. Explore Examples - 65 code examples demonstrating all features
3. Read the User Guide - Complete usage documentation
4. Learn Scan Types - TCP, UDP, stealth scanning techniques

Recommended Learning Path

Week 1: Basics

• Complete Tutorial 1-3 (Your First Scan, Scan Types, Service Detection)
• Practice on scanme.nmap.org
• Learn to interpret results

Week 2: Intermediate

• Complete Tutorial 4-5 (Advanced Service Detection, Stealth Scanning)
• Scan your own network
• Start using output formats

Week 3: Advanced

• Complete Tutorial 6-7 (Large-Scale Scanning, Plugin Development)
• Explore evasion techniques
• Write custom plugins

Week 4: Mastery

• Read Advanced Topics guides
• Performance tuning
• Integration with other tools
• Contribute to the project

Getting Help

Documentation:

• User Guide - Comprehensive usage guide
• Feature Guides - Deep dives into specific features
• Advanced Topics - Performance and optimization
• FAQ - Frequently asked questions

Community:

• GitHub Issues: https://github.com/doublegate/ProRT-IP/issues
• Discussions: https://github.com/doublegate/ProRT-IP/discussions

Support:

• Troubleshooting Guide
• Error Reference

Important Reminders

⚠️ Legal Notice:

• Only scan networks you own or have explicit written permission to test
• Unauthorized scanning may violate laws (CFAA, CMA, etc.)
• Always get proper authorization before scanning

⚠️ Ethical Use:

• Use for authorized security testing only
• Respect network resources and bandwidth
• Follow responsible disclosure for vulnerabilities found

⚠️ Technical Considerations:

• Some scans require root/admin privileges (sudo)
• Firewalls may block or detect scans
• Internet scans may be rate-limited by ISP
• Production scans may impact network performance

Last Updated: 2024-11-15 ProRT-IP Version: v0.5.2

Tutorial: Your First Scan

Step-by-step tutorials to master ProRT-IP WarScan from basic to advanced usage.

Tutorial Path

• Beginner (Tutorial 1-3): Basic scanning, scan types, service detection
• Intermediate (Tutorial 4-5): Advanced service detection, stealth scanning
• Advanced (Tutorial 6-7): Large-scale scanning, plugin development

Tutorial 1: Your First Scan

Objective: Complete a basic port scan and understand the output

Prerequisites:

• ProRT-IP installed
• Terminal access
• Internet connection

Step 1: Verify Installation

Command:

prtip --version

Expected Output:

ProRT-IP v0.5.2

Verification: Version should be 0.5.0 or higher. If not, see Installation Guide.

Step 2: Scan a Single Host

Command:

prtip -sS -p 80,443 scanme.nmap.org

Explanation:

• -sS: TCP SYN scan (requires root/admin privileges)
• -p 80,443: Scan ports 80 (HTTP) and 443 (HTTPS)
• scanme.nmap.org: Target host (Nmap's public scan target)

Expected Output:

[✓] Starting TCP SYN scan of scanme.nmap.org (45.33.32.156)
[✓] Scanning 2 ports (80, 443)

PORT    STATE   SERVICE
80/tcp  open    http
443/tcp open    https

[✓] Scan complete: 2 ports scanned, 2 open (100.00%)
[✓] Duration: 1.23s

Step 3: Understand the Output

Port Column:

• Format: PORT/PROTOCOL
• Example: 80/tcp = Port 80 using TCP protocol

State Column:

• open: Service accepting connections
• closed: Port accessible but no service
• filtered: Blocked by firewall

Service Column:

• Common service name (HTTP, HTTPS, SSH, etc.)
• Based on port number (not version detection)

Step 4: Save Results

Command:

prtip -sS -p 80,443 scanme.nmap.org -oN scan-results.txt

Explanation:

• -oN scan-results.txt: Normal output to file

Output Formats:

• -oN: Normal (human-readable)
• -oX: XML (machine-parseable)
• -oJ: JSON (modern APIs)
• -oG: Greppable (one-line per host)

Step 5: Practice Exercise

Task: Scan scanme.nmap.org for common web ports (80, 443, 8080, 8443)

Your Command:

# Write your command here
prtip -sS -p 80,443,8080,8443 scanme.nmap.org

Expected Result:

• 2-4 open ports (80 and 443 typically open)
• Scan duration: 1-3 seconds

Tutorial 2: Understanding Scan Types

Objective: Learn different scan types and when to use them

Scan Type Overview

Exercise 2.1: SYN Scan vs Connect Scan

SYN Scan (requires root):

sudo prtip -sS -p 1-1000 192.168.1.1

Connect Scan (no root needed):

prtip -sT -p 1-1000 192.168.1.1

Comparison:

• SYN: Faster (half-open connection), stealthier (no full TCP handshake)
• Connect: Slower (full connection), logged by target, works without privileges

When to Use:

• SYN: Default choice for privileged scanning (95% of use cases)
• Connect: When you don't have root access

Exercise 2.2: UDP Scan

Command:

sudo prtip -sU -p 53,161,123 192.168.1.1

UDP Services:

• Port 53: DNS
• Port 161: SNMP
• Port 123: NTP

Why UDP is Slower:

• No ACK response from open ports
• Requires waiting for timeout
• ICMP Port Unreachable needed to confirm closed

Expected Duration: 10-60 seconds for 3 ports (vs 1-2 seconds for TCP)

Exercise 2.3: Stealth Scans

FIN Scan:

sudo prtip -sF -p 80,443 scanme.nmap.org

How it Works:

• Sends FIN packet (normally used to close connection)
• Open ports: No response
• Closed ports: RST response

Limitations:

• Windows/Cisco devices respond incorrectly (false positives)
• Less accurate than SYN (60% vs 95%)

When to Use:

• Evading simple packet filters
• Testing firewall rules
• When extreme stealth is required

Practice Exercise

Task: Compare SYN scan vs FIN scan on the same target

# SYN Scan
sudo prtip -sS -p 80,443 scanme.nmap.org -oN syn-scan.txt

# FIN Scan
sudo prtip -sF -p 80,443 scanme.nmap.org -oN fin-scan.txt

# Compare results
diff syn-scan.txt fin-scan.txt

Expected Differences:

• SYN: Both ports "open"
• FIN: Both ports "open|filtered" (less certain)

Tutorial 3: Service Detection

Objective: Identify service versions running on open ports

Basic Service Detection

Command:

sudo prtip -sV -p 80,443,22 scanme.nmap.org

Explanation:

• -sV: Enable service version detection
• Probes open ports to identify software and version

Expected Output:

PORT    STATE   SERVICE  VERSION
22/tcp  open    ssh      OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13
80/tcp  open    http     Apache httpd 2.4.7
443/tcp open    ssl/http Apache httpd 2.4.7

Service Detection Intensity

Intensity Levels (0-9):

# Light detection (intensity 2, faster but less accurate)
sudo prtip -sV --version-intensity 2 -p 80 scanme.nmap.org

# Default detection (intensity 7, balanced)
sudo prtip -sV -p 80 scanme.nmap.org

# Aggressive detection (intensity 9, slower but comprehensive)
sudo prtip -sV --version-intensity 9 -p 80 scanme.nmap.org

Trade-offs:

• Low intensity (2): 5-10 seconds per port, 70% accuracy
• Default (7): 15-30 seconds per port, 85-90% accuracy
• High intensity (9): 30-60 seconds per port, 95% accuracy

Protocol-Specific Detection

HTTP Service:

sudo prtip -sV -p 80 --script=http-title scanme.nmap.org

SSH Service:

sudo prtip -sV -p 22 scanme.nmap.org

Database Services:

sudo prtip -sV -p 3306,5432,1433 192.168.1.100

TLS Certificate Analysis

Command:

sudo prtip -sV -p 443 --script=ssl-cert scanme.nmap.org

Certificate Information Extracted:

• Subject (domain name)
• Issuer (Certificate Authority)
• Validity period (not before/after dates)
• Subject Alternative Names (SANs)
• Signature algorithm
• Public key algorithm

Example Output:

PORT     STATE SERVICE   VERSION
443/tcp  open  ssl/http  Apache httpd 2.4.7
| ssl-cert: Subject: commonName=scanme.nmap.org
| Issuer: commonName=Let's Encrypt Authority X3
| Not valid before: 2024-01-15T00:00:00
| Not valid after:  2024-04-15T23:59:59
| SANs: scanme.nmap.org, www.scanme.nmap.org

Practice Exercise

Task: Identify all services on common ports of a local device

# Scan common service ports with version detection
sudo prtip -sV -p 21,22,23,25,80,110,143,443,445,3389 192.168.1.1

Questions to Answer:

1. What web server version is running (if any)?
2. Is SSH enabled? What version?
3. Are there any outdated services with known vulnerabilities?

Vulnerability Research:

# Search for known vulnerabilities
# Example: If you find "Apache 2.2.8"
searchsploit "Apache 2.2.8"

Tutorial 4: Advanced Service Detection

Objective: Master advanced service detection techniques

HTTP-Specific Detection

Title Extraction:

sudo prtip -sV -p 80,443,8080,8443 --script=http-title 192.168.1.0/24

Server Headers:

sudo prtip -sV -p 80 --script=http-headers scanme.nmap.org

Example Output:

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.7
| http-headers:
|   Server: Apache/2.4.7 (Ubuntu)
|   X-Powered-By: PHP/5.5.9-1ubuntu4.29
|   Content-Type: text/html; charset=UTF-8

Database Service Detection

MySQL:

sudo prtip -sV -p 3306 192.168.1.100

PostgreSQL:

sudo prtip -sV -p 5432 192.168.1.100

Expected Output:

PORT     STATE SERVICE  VERSION
3306/tcp open  mysql    MySQL 5.7.32-0ubuntu0.16.04.1
5432/tcp open  postgresql PostgreSQL 12.2

Multi-Protocol Detection

Scan all common services:

sudo prtip -sV -p 21,22,23,25,53,80,110,143,443,445,3306,3389,5432,8080 192.168.1.1

Service Categories:

• Remote Access: 22 (SSH), 23 (Telnet), 3389 (RDP)
• Web Services: 80 (HTTP), 443 (HTTPS), 8080 (HTTP-Alt)
• Mail Services: 25 (SMTP), 110 (POP3), 143 (IMAP)
• Database Services: 3306 (MySQL), 5432 (PostgreSQL)
• File Sharing: 445 (SMB)
• DNS: 53

Practice Exercise

Task: Create a comprehensive service inventory of your local network

# Step 1: Discover live hosts
sudo prtip -sn 192.168.1.0/24 -oN live-hosts.txt

# Step 2: Extract IP addresses
grep "is up" live-hosts.txt | awk '{print $2}' > targets.txt

# Step 3: Service detection on all targets
sudo prtip -sV -p 1-1000 -iL targets.txt -oN service-inventory.txt

# Step 4: Analyze results
grep "open" service-inventory.txt | sort | uniq -c

Expected Deliverable:

• Complete list of all services on your network
• Version information for each service
• Potential security concerns (outdated versions)

Tutorial 5: Stealth Scanning Techniques

Objective: Evade detection while gathering intelligence

Timing Templates

Paranoid (T0):

sudo prtip -sS -T0 -p 80,443 scanme.nmap.org

Configuration:

• 5 minutes between probes
• Single probe at a time
• Minimal footprint
• Use case: Evading IDS

Sneaky (T1):

sudo prtip -sS -T1 -p 80,443 scanme.nmap.org

Configuration:

• 15 seconds between probes
• Use case: Slow scan to avoid detection

Polite (T2):

sudo prtip -sS -T2 -p 80,443 scanme.nmap.org

Configuration:

• 0.4 seconds between probes
• Reduces bandwidth usage
• Use case: Scanning production systems

Normal (T3) - Default:

sudo prtip -sS -p 80,443 scanme.nmap.org

Aggressive (T4):

sudo prtip -sS -T4 -p 80,443 scanme.nmap.org

Configuration:

• 5ms probe delay
• 1 second timeout
• Use case: Fast local network scanning

Insane (T5):

sudo prtip -sS -T5 -p 80,443 scanme.nmap.org

Configuration:

• No probe delay
• 0.3 second timeout
• Use case: Very fast networks only
• Warning: May miss results due to timeouts

Decoy Scanning

Basic Decoy:

sudo prtip -sS -D RND:5 -p 80,443 scanme.nmap.org

Explanation:

• -D RND:5: Use 5 random decoy IP addresses
• Target sees scans from 6 IPs (5 decoys + your real IP)
• Makes it harder to identify the true source

Manual Decoy IPs:

sudo prtip -sS -D 192.168.1.10,192.168.1.20,ME,192.168.1.30 -p 80 scanme.nmap.org

Explanation:

• ME: Your real IP position in the decoy list
• Other IPs: Decoy addresses

Best Practices:

• Use IPs that are active on the network
• Place ME in a random position (not always first/last)
• Use 3-10 decoys (too many is suspicious)

IP Fragmentation

Fragment Packets:

sudo prtip -sS -f -p 80,443 scanme.nmap.org

Explanation:

• -f: Fragment IP packets into 8-byte chunks
• Evades some packet filters and firewalls
• May bypass simple IDS

Custom MTU:

sudo prtip -sS --mtu 16 -p 80,443 scanme.nmap.org

MTU Values:

• Must be multiple of 8
• Common values: 8, 16, 24, 32
• Smaller = more fragments = harder to reassemble

TTL Manipulation

Custom TTL:

sudo prtip -sS --ttl 32 -p 80,443 scanme.nmap.org

Use Cases:

• Bypass simple packet filters checking for unusual TTL
• Evade traceroute-based detection

Combined Stealth Techniques

Maximum Stealth:

sudo prtip -sF -T0 -D RND:10 -f --ttl 64 --source-port 53 -p 80,443 scanme.nmap.org

Explanation:

• -sF: FIN scan (stealthy scan type)
• -T0: Paranoid timing (very slow)
• -D RND:10: 10 random decoys
• -f: IP fragmentation
• --ttl 64: Normal TTL value (less suspicious)
• --source-port 53: Spoof source port as DNS (often allowed through firewalls)

Expected Duration: 30-60 minutes for 2 ports

When to Use:

• Highly monitored networks
• IDS/IPS evasion required
• Time is not a constraint
• Legal testing only

Practice Exercise

Task: Test firewall evasion on a test network

# Step 1: Normal scan (baseline)
sudo prtip -sS -p 80,443 192.168.1.1 -oN normal-scan.txt

# Step 2: Stealth scan
sudo prtip -sF -T1 -D RND:5 -f -p 80,443 192.168.1.1 -oN stealth-scan.txt

# Step 3: Compare results
diff normal-scan.txt stealth-scan.txt

# Step 4: Check firewall logs (if accessible)
# Did the stealth scan generate fewer log entries?

Questions:

1. Did both scans detect the same open ports?
2. What was the time difference?
3. Were there fewer firewall log entries for the stealth scan?

Tutorial 6: Large-Scale Network Scanning

Objective: Efficiently scan entire networks

Subnet Scanning

Class C Network (256 hosts):

sudo prtip -sS -p 80,443 192.168.1.0/24

Expected Duration:

• 2-5 minutes for 256 hosts × 2 ports
• ~512 total port scans

Class B Network (65,536 hosts):

sudo prtip -sS -p 80,443 192.168.0.0/16 -T4

Expected Duration:

• 2-4 hours for 65,536 hosts × 2 ports
• ~131,072 total port scans

Optimization:

• Use -T4 or -T5 for faster scanning
• Limit port range (-p 80,443 vs -p 1-65535)
• Use --top-ports 100 for most common ports

Top Ports Scanning

Fast Scan (Top 100):

sudo prtip -F 192.168.1.0/24

Explanation:

• -F: Fast mode (scans top 100 ports)
• Equivalent to --top-ports 100

Top Ports Lists:

# Top 10 ports
sudo prtip --top-ports 10 192.168.1.0/24

# Top 1000 ports
sudo prtip --top-ports 1000 192.168.1.0/24

Host Discovery Before Scanning

Two-Phase Approach:

# Phase 1: Discover live hosts (fast)
sudo prtip -sn 192.168.1.0/24 -oN live-hosts.txt

# Phase 2: Port scan only live hosts
sudo prtip -sS -p 1-1000 -iL live-hosts.txt -oN port-scan.txt

Time Savings:

• If 20 out of 256 hosts are live: 92% reduction in scan time
• Phase 1: 1-2 minutes
• Phase 2: 5-10 minutes (vs 60-120 minutes scanning all 256 hosts)

Rate Limiting

Limit Packet Rate:

sudo prtip -sS -p 80,443 192.168.1.0/24 --max-rate 1000

Explanation:

• --max-rate 1000: Maximum 1,000 packets per second
• Prevents overwhelming the network
• Required for some production networks

Minimum Rate:

sudo prtip -sS -p 80,443 192.168.1.0/24 --min-rate 100

Explanation:

• --min-rate 100: Minimum 100 packets per second
• Ensures scan doesn't slow down too much
• Useful for large scans with timing constraints

Parallel Scanning

Scan Multiple Targets Simultaneously:

# Create target list
echo "192.168.1.0/24" > targets.txt
echo "10.0.0.0/24" >> targets.txt

# Scan all targets
sudo prtip -sS -p 80,443 -iL targets.txt -oN parallel-scan.txt

Practice Exercise

Task: Scan a large network and generate a comprehensive report

# Step 1: Define scope
NETWORK="192.168.0.0/16"

# Step 2: Host discovery
sudo prtip -sn $NETWORK -oN hosts.txt

# Step 3: Extract live IPs
grep "is up" hosts.txt | awk '{print $2}' > live.txt

# Step 4: Count live hosts
wc -l live.txt

# Step 5: Fast port scan (top 100 ports)
sudo prtip -sS -F -iL live.txt -oN ports.txt

# Step 6: Service detection on open ports
sudo prtip -sV -p 80,443,22,3389 -iL live.txt -oN services.txt

# Step 7: Generate summary
echo "=== Network Scan Summary ===" > summary.txt
echo "Total hosts scanned: $(wc -l < live.txt)" >> summary.txt
echo "Open ports found: $(grep -c 'open' ports.txt)" >> summary.txt
echo "Services identified: $(grep -c 'open' services.txt)" >> summary.txt

Expected Deliverables:

• hosts.txt: All live hosts
• ports.txt: Open ports on all hosts
• services.txt: Service versions
• summary.txt: High-level statistics

Tutorial 7: Plugin Development

Objective: Extend ProRT-IP with custom Lua plugins

Plugin Basics

Plugin Structure:

-- my-plugin.lua
return {
    name = "My Custom Plugin",
    version = "1.0.0",
    description = "Description of what this plugin does",

    -- Initialize plugin
    init = function(config)
        print("Plugin initialized")
    end,

    -- Process scan result
    process = function(result)
        -- result contains: ip, port, state, service
        if result.state == "open" then
            print(string.format("Found open port: %s:%d", result.ip, result.port))
        end
    end,

    -- Cleanup
    cleanup = function()
        print("Plugin cleanup")
    end
}

Example 1: HTTP Title Checker

Plugin: http-title-checker.lua

return {
    name = "HTTP Title Checker",
    version = "1.0.0",
    description = "Extracts HTML titles from HTTP responses",

    process = function(result)
        if result.service == "http" and result.state == "open" then
            -- Make HTTP request
            local response = prtip.http.get(result.ip, result.port, "/")

            -- Extract title
            local title = response.body:match("<title>(.-)</title>")
            if title then
                print(string.format("[%s:%d] Title: %s", result.ip, result.port, title))
            end
        end
    end
}

Usage:

sudo prtip -sS -p 80,443 192.168.1.0/24 --plugin http-title-checker.lua

Example 2: Vulnerability Scanner

Plugin: vuln-scanner.lua

local vulns = {
    ["Apache 2.2.8"] = "CVE-2011-3192 (Range DoS)",
    ["OpenSSH 6.6"] = "CVE-2016-0777 (Info leak)",
    ["MySQL 5.5.59"] = "CVE-2018-2562 (Privilege escalation)"
}

return {
    name = "Simple Vulnerability Scanner",
    version = "1.0.0",
    description = "Checks for known vulnerable versions",

    process = function(result)
        if result.version then
            local vuln = vulns[result.version]
            if vuln then
                print(string.format("[VULN] %s:%d %s - %s",
                    result.ip, result.port, result.version, vuln))
            end
        end
    end
}

Usage:

sudo prtip -sV -p 1-1000 192.168.1.0/24 --plugin vuln-scanner.lua

Example 3: Custom Logger

Plugin: custom-logger.lua

local log_file = nil

return {
    name = "Custom Logger",
    version = "1.0.0",
    description = "Logs results to custom format",

    init = function(config)
        log_file = io.open("scan-log.csv", "w")
        log_file:write("Timestamp,IP,Port,State,Service,Version\n")
    end,

    process = function(result)
        local timestamp = os.date("%Y-%m-%d %H:%M:%S")
        log_file:write(string.format("%s,%s,%d,%s,%s,%s\n",
            timestamp,
            result.ip,
            result.port,
            result.state,
            result.service or "",
            result.version or ""))
        log_file:flush()
    end,

    cleanup = function()
        if log_file then
            log_file:close()
        end
    end
}

Usage:

sudo prtip -sS -p 1-1000 192.168.1.0/24 --plugin custom-logger.lua

Plugin API Reference

Available Functions:

-- HTTP requests
prtip.http.get(ip, port, path)
prtip.http.post(ip, port, path, data)

-- DNS lookups
prtip.dns.resolve(hostname)
prtip.dns.reverse(ip)

-- Port state checks
prtip.port.is_open(ip, port)

-- Service detection
prtip.service.detect(ip, port)

-- Banner grabbing
prtip.banner.grab(ip, port)

Practice Exercise

Task: Create a plugin that identifies web servers with directory listing enabled

-- directory-listing-checker.lua
return {
    name = "Directory Listing Checker",
    version = "1.0.0",
    description = "Checks for directory listing vulnerability",

    process = function(result)
        if result.service == "http" and result.state == "open" then
            local response = prtip.http.get(result.ip, result.port, "/")

            -- Check for common directory listing indicators
            if response.body:match("Index of /") or
               response.body:match("Directory listing") or
               response.body:match("Parent Directory") then
                print(string.format("[VULN] %s:%d - Directory listing enabled",
                    result.ip, result.port))
            end
        end
    end
}

Test:

sudo prtip -sS -p 80,8080 192.168.1.0/24 --plugin directory-listing-checker.lua

Practice Exercises

Exercise 1: Basic Network Mapping

Objective: Map all services on your local network

Steps:

1. Discover live hosts on your network
2. Scan top 1000 ports on all live hosts
3. Run service detection on open ports
4. Create a network diagram showing all services

Commands:

# Replace 192.168.1.0/24 with your network
sudo prtip -sn 192.168.1.0/24 -oN hosts.txt
sudo prtip -sS --top-ports 1000 -iL hosts.txt -oN ports.txt
sudo prtip -sV -iL hosts.txt -oN services.txt

Deliverable: Document showing all devices, open ports, and running services

Exercise 2: Firewall Testing

Objective: Test firewall rules on a test system

Steps:

1. Perform normal SYN scan
2. Perform stealth scans (FIN, NULL, Xmas)
3. Try fragmentation and decoys
4. Compare results

Commands:

sudo prtip -sS -p 1-1000 TARGET -oN syn.txt
sudo prtip -sF -p 1-1000 TARGET -oN fin.txt
sudo prtip -sN -p 1-1000 TARGET -oN null.txt
sudo prtip -sX -p 1-1000 TARGET -oN xmas.txt
sudo prtip -sS -f -D RND:10 -p 1-1000 TARGET -oN stealth.txt

Deliverable: Analysis showing which scans were successful and which were blocked

Exercise 3: Service Inventory

Objective: Create comprehensive service inventory

Steps:

1. Scan all hosts with service detection
2. Extract all unique services
3. Identify outdated versions
4. Research known vulnerabilities

Commands:

sudo prtip -sV -p 1-10000 192.168.1.0/24 -oN inventory.txt
grep "open" inventory.txt | awk '{print $3, $4, $5}' | sort | uniq > services.txt

Deliverable: Spreadsheet showing all services, versions, and known vulnerabilities

Exercise 4: Performance Testing

Objective: Test scanning performance on different network types

Test Cases:

1. Localhost (127.0.0.1)
2. Local network (192.168.1.0/24)
3. Internet host (scanme.nmap.org)

Commands:

# Localhost
time sudo prtip -sS -p 1-65535 127.0.0.1

# Local network
time sudo prtip -sS -p 1-1000 192.168.1.1

# Internet host
time sudo prtip -sS -p 1-1000 scanme.nmap.org

Deliverable: Performance report showing scan times and packets per second

Exercise 5: Custom Plugin Development

Objective: Create a plugin for a specific detection need

Requirements:

• Detect specific service (e.g., Redis, MongoDB, Elasticsearch)
• Check for default credentials
• Log findings to custom format

Template:

return {
    name = "Your Plugin Name",
    version = "1.0.0",
    description = "Your description",

    init = function(config)
        -- Initialize plugin
    end,

    process = function(result)
        -- Process each scan result
    end,

    cleanup = function()
        -- Cleanup
    end
}

Exercise 6: Scan Script Automation

Objective: Create automated scanning workflow

Requirements:

1. Daily network scan
2. Email notification if new hosts/services discovered
3. Log all changes

Bash Script Template:

#!/bin/bash
NETWORK="192.168.1.0/24"
DATE=$(date +%Y-%m-%d)
LOGDIR="/var/log/scans"

# Create log directory
mkdir -p $LOGDIR

# Scan network
sudo prtip -sS -p 1-1000 $NETWORK -oN "$LOGDIR/scan-$DATE.txt"

# Compare with previous scan
if [ -f "$LOGDIR/scan-previous.txt" ]; then
    diff "$LOGDIR/scan-previous.txt" "$LOGDIR/scan-$DATE.txt" > "$LOGDIR/changes-$DATE.txt"

    if [ -s "$LOGDIR/changes-$DATE.txt" ]; then
        # Changes detected, send email
        mail -s "Network Changes Detected" admin@example.com < "$LOGDIR/changes-$DATE.txt"
    fi
fi

# Update previous scan
cp "$LOGDIR/scan-$DATE.txt" "$LOGDIR/scan-previous.txt"

Exercise 7: IPv6 Scanning

Objective: Scan IPv6 networks

Steps:

1. Discover IPv6 hosts on local network
2. Scan common IPv6 ports
3. Compare with IPv4 scan results

Commands:

# IPv6 scan
sudo prtip -6 -sS -p 80,443 fe80::/10

# IPv4 scan (for comparison)
sudo prtip -sS -p 80,443 192.168.1.0/24

Exercise 8: Idle Scan

Objective: Perform anonymous scanning using idle scan technique

Requirements:

• Identify zombie host (low-traffic host)
• Perform idle scan through zombie
• Verify results

Commands:

# Find potential zombie hosts
sudo prtip -sI --find-zombies 192.168.1.0/24

# Perform idle scan
sudo prtip -sI ZOMBIE_IP -p 80,443 TARGET_IP

Exercise 9: Large-Scale Internet Scanning

Objective: Scan a large IP range efficiently

Requirements:

• Scan at least /16 network
• Use appropriate timing
• Generate comprehensive report

Commands:

# Phase 1: Host discovery
sudo prtip -sn 10.0.0.0/16 -oN hosts.txt --max-rate 1000

# Phase 2: Port scan
sudo prtip -sS --top-ports 100 -iL hosts.txt -oN ports.txt -T4

# Phase 3: Service detection
sudo prtip -sV -iL hosts.txt -oN services.txt

Expected Duration: 2-6 hours depending on network size and timing

Common Pitfalls

Pitfall 1: Insufficient Privileges

Error:

Error: You need root privileges to run SYN scan (-sS)

Solution:

# Use sudo
sudo prtip -sS -p 80,443 TARGET

# OR use Connect scan (no privileges needed)
prtip -sT -p 80,443 TARGET

Pitfall 2: Firewall Blocking

Symptom: All ports show as "filtered"

Diagnosis:

# Try different scan types
sudo prtip -sS -p 80 TARGET  # SYN scan
sudo prtip -sA -p 80 TARGET  # ACK scan (firewall mapping)

Solution:

• Use fragmentation: -f
• Use decoys: -D RND:10
• Source port spoofing: --source-port 53

Pitfall 3: Slow Scans

Problem: Scan takes hours for small network

Diagnosis:

# Check if using slow timing
prtip -v -sS TARGET  # Shows timing being used

Solutions:

# Increase timing
sudo prtip -sS -T4 TARGET

# Limit port range
sudo prtip -sS --top-ports 100 TARGET

# Increase max rate
sudo prtip -sS --max-rate 1000 TARGET

Pitfall 4: Incorrect Port Ranges

Error:

# Wrong: Port 0 doesn't exist
prtip -sS -p 0-1000 TARGET

# Correct: Start from port 1
prtip -sS -p 1-1000 TARGET

Common Ranges:

• Well-known ports: 1-1023
• Registered ports: 1024-49151
• Dynamic ports: 49152-65535
• All ports: 1-65535 or -p-

Next Steps

After completing these tutorials:

1. Read the User Guide: ../user-guide/basic-usage.md
2. Explore Feature Guides: ../features/
3. Review Examples: ./examples.md
4. Advanced Topics: ../advanced/

Additional Resources:

• Scan Types Reference
• Service Detection Guide
• Stealth Techniques
• Performance Tuning
• Plugin Development Guide

Practice Labs:

• scanme.nmap.org - Official Nmap test target
• HackTheBox - Penetration testing labs
• TryHackMe (tryhackme.com) - Security training platform

Community:

• GitHub Issues: https://github.com/doublegate/ProRT-IP/issues
• Discussions: https://github.com/doublegate/ProRT-IP/discussions

Example Scans Gallery

Comprehensive collection of 65 runnable examples demonstrating ProRT-IP capabilities.

Quick Navigation

• Tier 1: Feature-Complete Examples (20 examples) - Production-ready use cases
• Tier 2: Focused Demonstrations (30 examples) - Specific feature showcases
• Tier 3: Skeleton Templates (15 examples) - Development starting points

How to Run Examples

From Source

# Run a specific example
cargo run --example common_basic_syn_scan

# Run with release optimizations
cargo run --release --example performance_large_subnet

# Run with elevated privileges (for raw sockets)
sudo cargo run --example stealth_fin_scan

From Installed Binary

# Most examples demonstrate CLI usage
prtip -sS -p 80,443 192.168.1.0/24

# See example comments for exact command
cat examples/common_basic_syn_scan.rs

Categories

Tier 1: Feature-Complete Examples (20)

Production-ready examples demonstrating complete use cases with error handling, logging, and best practices.

Common Use Cases (15)

Advanced Techniques (5)

Tier 2: Focused Demonstrations (30)

Focused examples demonstrating specific features or techniques.

Scan Types (8)

Service Detection (5)

Evasion Techniques (5)

IPv6 Support (3)

Performance (4)

Output Formats (3)

Plugin System (2)

Tier 3: Skeleton Templates (15)

Development starting points with TODO markers and architecture guidance.

Integration Examples (5)

Custom Scanners (5)

Automation (5)

Example Code Snippets

Example 1: Basic SYN Scan

File: examples/common_basic_syn_scan.rs

use prtip_scanner::{Scanner, ScanConfig};
use std::net::IpAddr;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Configure scan
    let config = ScanConfig::builder()
        .scan_type(ScanType::Syn)
        .ports(vec![80, 443])
        .timing(TimingTemplate::Normal)
        .build()?;

    // Create scanner
    let mut scanner = Scanner::new(config)?;

    // Target
    let target: IpAddr = "192.168.1.1".parse()?;

    // Initialize scanner (elevated privileges required)
    scanner.initialize().await?;

    // Execute scan
    let results = scanner.scan_target(target).await?;

    // Print results
    for result in results {
        println!("{:?}", result);
    }

    Ok(())
}

Usage:

sudo cargo run --example common_basic_syn_scan

Example 2: Service Detection

File: examples/common_service_detection.rs

use prtip_scanner::{Scanner, ScanConfig, ServiceDetector};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Configure scan with service detection
    let config = ScanConfig::builder()
        .scan_type(ScanType::Syn)
        .ports(vec![22, 80, 443, 3306, 5432])
        .enable_service_detection(true)
        .service_intensity(7)  // 0-9, higher = more accurate
        .build()?;

    let mut scanner = Scanner::new(config)?;
    scanner.initialize().await?;

    let target = "192.168.1.100".parse()?;
    let results = scanner.scan_target(target).await?;

    // Service detection results
    for result in results {
        if let Some(service) = result.service {
            println!("Port {}: {} {}",
                result.port,
                service.name,
                service.version.unwrap_or_default()
            );
        }
    }

    Ok(())
}

Expected Output:

Port 22: ssh OpenSSH 7.9p1
Port 80: http Apache httpd 2.4.41
Port 443: https Apache httpd 2.4.41 (SSL)
Port 3306: mysql MySQL 5.7.32
Port 5432: postgresql PostgreSQL 12.4

Example 3: Stealth Scan with Evasion

File: examples/advanced_combined_evasion.rs

use prtip_scanner::{Scanner, ScanConfig, EvasionConfig};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Maximum stealth configuration
    let evasion = EvasionConfig::builder()
        .decoys(vec!["192.168.1.10", "192.168.1.20", "ME", "192.168.1.30"])
        .fragmentation(true)
        .mtu(16)  // Fragment size
        .ttl(64)  // Normal TTL
        .source_port(53)  // DNS source port
        .bad_checksum(false)  // Don't use badsum (makes scan invalid)
        .build()?;

    let config = ScanConfig::builder()
        .scan_type(ScanType::Fin)  // Stealth scan
        .ports(vec![80, 443])
        .timing(TimingTemplate::Sneaky)  // T1
        .evasion(evasion)
        .build()?;

    let mut scanner = Scanner::new(config)?;
    scanner.initialize().await?;

    let target = "scanme.nmap.org".parse()?;
    let results = scanner.scan_target(target).await?;

    for result in results {
        println!("{:?}", result);
    }

    Ok(())
}

Example 4: Large Subnet Scan

File: examples/performance_large_subnet.rs

use prtip_scanner::{Scanner, ScanConfig};
use ipnetwork::IpNetwork;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Configure for large-scale scanning
    let config = ScanConfig::builder()
        .scan_type(ScanType::Syn)
        .ports(vec![80, 443])  // Limited ports for speed
        .timing(TimingTemplate::Aggressive)  // T4
        .max_rate(10000)  // 10K packets/second
        .parallelism(1000)  // 1000 concurrent targets
        .build()?;

    let mut scanner = Scanner::new(config)?;
    scanner.initialize().await?;

    // Scan /16 network (65,536 hosts)
    let network: IpNetwork = "10.0.0.0/16".parse()?;

    println!("Scanning {} hosts...", network.size());
    let start = std::time::Instant::now();

    let results = scanner.scan_network(network).await?;

    let duration = start.elapsed();
    println!("Scan complete in {:?}", duration);
    println!("Found {} open ports", results.len());
    println!("Throughput: {:.2} ports/sec",
        results.len() as f64 / duration.as_secs_f64());

    Ok(())
}

Example 5: Custom Plugin

File: examples/plugin_custom_logger.rs

Lua Plugin: plugins/custom-logger.lua

local log_file = nil

return {
    name = "Custom CSV Logger",
    version = "1.0.0",
    description = "Logs scan results to CSV format",

    init = function(config)
        log_file = io.open("scan-results.csv", "w")
        log_file:write("Timestamp,IP,Port,State,Service,Version\n")
    end,

    process = function(result)
        local timestamp = os.date("%Y-%m-%d %H:%M:%S")
        log_file:write(string.format("%s,%s,%d,%s,%s,%s\n",
            timestamp,
            result.ip,
            result.port,
            result.state,
            result.service or "",
            result.version or ""))
        log_file:flush()
    end,

    cleanup = function()
        if log_file then
            log_file:close()
        end
    end
}

Rust Code:

use prtip_scanner::{Scanner, ScanConfig, PluginManager};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Load plugin
    let plugin_manager = PluginManager::new()?;
    plugin_manager.load_plugin("plugins/custom-logger.lua")?;

    // Configure scan
    let config = ScanConfig::builder()
        .scan_type(ScanType::Syn)
        .ports(vec![80, 443, 22, 3389])
        .plugin_manager(plugin_manager)
        .build()?;

    let mut scanner = Scanner::new(config)?;
    scanner.initialize().await?;

    // Scan network
    let network = "192.168.1.0/24".parse()?;
    let results = scanner.scan_network(network).await?;

    println!("Results logged to scan-results.csv");
    println!("Total results: {}", results.len());

    Ok(())
}

Output: scan-results.csv

Timestamp,IP,Port,State,Service,Version
2024-11-15 10:30:15,192.168.1.1,80,open,http,Apache 2.4.41
2024-11-15 10:30:15,192.168.1.1,443,open,https,Apache 2.4.41
2024-11-15 10:30:16,192.168.1.10,22,open,ssh,OpenSSH 7.9
2024-11-15 10:30:17,192.168.1.100,3389,open,rdp,Microsoft RDP

Running Examples by Category

Quick Scans (< 1 minute)

# Single host, common ports
cargo run --example common_basic_syn_scan

# Fast scan (top 100 ports)
cargo run --example common_fast_scan

# Service detection on few ports
cargo run --example service_http_detection

Medium Scans (1-10 minutes)

# Subnet scan (/24)
cargo run --example common_subnet_scan

# Service detection on network
cargo run --example common_service_detection

# OS fingerprinting
cargo run --example common_os_fingerprinting

Long Scans (> 10 minutes)

# Large subnet (/16)
cargo run --release --example performance_large_subnet

# Comprehensive network audit
cargo run --release --example common_network_audit

# Stealth scan with slow timing
sudo cargo run --example evasion_timing_t0

Stealth Scans

# FIN scan
cargo run --example scan_types_fin

# Decoy scanning
cargo run --example advanced_decoy_scan

# Combined evasion
cargo run --example advanced_combined_evasion

IPv6 Examples

# Basic IPv6 scan
cargo run --example ipv6_basic_scan

# NDP discovery
cargo run --example ipv6_ndp_discovery

# ICMPv6 scan
cargo run --example ipv6_icmpv6_scan

Example Output Formats

Normal Output

Starting ProRT-IP v0.5.2 ( https://github.com/doublegate/ProRT-IP )
Scan report for 192.168.1.1
Host is up (0.0012s latency).

PORT     STATE  SERVICE    VERSION
22/tcp   open   ssh        OpenSSH 7.9p1 Debian 10+deb10u2
80/tcp   open   http       Apache httpd 2.4.41 ((Debian))
443/tcp  open   ssl/http   Apache httpd 2.4.41 ((Debian))
3306/tcp open   mysql      MySQL 5.7.32-0ubuntu0.18.04.1

Scan complete: 4 ports scanned, 4 open, 0 closed, 0 filtered

JSON Output

{
  "scan_info": {
    "version": "0.5.2",
    "scan_type": "syn",
    "start_time": "2024-11-15T10:30:00Z",
    "end_time": "2024-11-15T10:30:15Z",
    "duration_seconds": 15
  },
  "targets": [
    {
      "ip": "192.168.1.1",
      "hostname": "router.local",
      "state": "up",
      "latency_ms": 1.2,
      "ports": [
        {
          "port": 80,
          "protocol": "tcp",
          "state": "open",
          "service": {
            "name": "http",
            "product": "Apache httpd",
            "version": "2.4.41",
            "extra_info": "(Debian)"
          }
        }
      ]
    }
  ]
}

XML Output (Nmap Compatible)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<nmaprun scanner="prtip" args="-sS -p 80,443" start="1700053800" version="0.5.2">
  <scaninfo type="syn" protocol="tcp" numservices="2" services="80,443"/>
  <host starttime="1700053800" endtime="1700053815">
    <status state="up" reason="echo-reply"/>
    <address addr="192.168.1.1" addrtype="ipv4"/>
    <ports>
      <port protocol="tcp" portid="80">
        <state state="open" reason="syn-ack"/>
        <service name="http" product="Apache httpd" version="2.4.41"/>
      </port>
      <port protocol="tcp" portid="443">
        <state state="open" reason="syn-ack"/>
        <service name="https" product="Apache httpd" version="2.4.41" tunnel="ssl"/>
      </port>
    </ports>
  </host>
  <runstats>
    <finished time="1700053815" elapsed="15"/>
    <hosts up="1" down="0" total="1"/>
  </runstats>
</nmaprun>

Next Steps

After exploring these examples:

1. Read the Tutorials - Step-by-step learning path
2. Explore the User Guide - Comprehensive usage documentation
3. Review Feature Guides - Deep dives into specific features
4. Study Advanced Topics - Performance tuning and optimization

Contributing Examples

Have a useful example? Contribute it!

1. Fork the repository
2. Add your example to examples/
3. Add entry to this gallery
4. Submit pull request

Example Contribution Guidelines:

• Include comprehensive comments
• Add error handling
• Follow Rust best practices
• Test on multiple platforms
• Document expected output
• Specify required privileges

See Contributing Guide for details.

Last Updated: 2024-11-15 Examples Count: 65 total (20 complete, 30 focused, 15 templates)

Basic Usage

Learn the fundamentals of ProRT-IP WarScan command-line interface.

Command Syntax

General Format:

prtip [OPTIONS] <TARGET>

Examples:

prtip 192.168.1.1                    # Basic scan (default ports)
prtip -p 80,443 example.com          # Specific ports
prtip -sS -p 1-1000 10.0.0.0/24      # SYN scan, port range, CIDR

Target Specification

Single IP

prtip 192.168.1.1
prtip example.com

CIDR Notation

prtip 192.168.1.0/24        # Scan 192.168.1.1-254
prtip 10.0.0.0/16           # Scan 10.0.0.1-10.0.255.254

IP Range

prtip 192.168.1.1-50        # Scan 192.168.1.1 to 192.168.1.50
prtip 192.168.1-10.1        # Scan 192.168.1.1 to 192.168.10.1

Multiple Targets

prtip 192.168.1.1 192.168.1.2 192.168.1.3
prtip 192.168.1.1/24 10.0.0.1/24

From File

prtip -iL targets.txt

targets.txt content:

192.168.1.1
10.0.0.0/24
example.com

IPv6

prtip -6 2001:db8::1
prtip -6 2001:db8::/64

Port Specification

Specific Ports

prtip -p 80,443,8080 TARGET

Port Range

prtip -p 1-100 TARGET          # Ports 1-100
prtip -p- TARGET               # All ports (1-65535)

Common Ports (Fast)

prtip -F TARGET                # Top 100 ports

Exclude Ports

prtip -p 1-1000 --exclude-ports 135,139,445 TARGET

Service Names

prtip -p http,https,ssh TARGET   # Resolves to 80,443,22

Common Use Cases

Network Discovery

Goal: Find all active hosts on local network

Command:

sudo prtip -sn 192.168.1.0/24

Explanation:

• -sn: Ping scan only (no port scan)
• 192.168.1.0/24: Scan entire /24 subnet (192.168.1.1-254)

Expected Output:

Host 192.168.1.1 is up (latency: 2.3ms)
Host 192.168.1.5 is up (latency: 1.8ms)
Host 192.168.1.10 is up (latency: 3.1ms)
...
Scan complete: 3 hosts up (254 scanned)

Port Scanning

Common Ports (Fast)

Goal: Quickly identify common services

Command:

sudo prtip -sS -F 192.168.1.10

Explanation:

• -F: Fast scan (top 100 ports)
• Completes in seconds

Expected Output:

PORT    STATE  SERVICE
22/tcp  open   ssh
80/tcp  open   http
443/tcp open   https
3306/tcp open  mysql

Full Port Scan

Goal: Comprehensive scan of all 65,535 ports

Command:

sudo prtip -sS -p- -T4 192.168.1.10 -oN fullscan.txt

Explanation:

• -p-: All ports (1-65535)
• -T4: Aggressive timing (faster)
• -oN fullscan.txt: Save results

Note: Full scan can take 5-30 minutes depending on network and timing template.

Custom Port List

Goal: Scan specific ports of interest

Command:

sudo prtip -sS -p 80,443,8080,8443,3000,3306 192.168.1.10

Explanation:

• Web ports: 80, 443, 8080, 8443, 3000
• Database port: 3306 (MySQL)

Service Detection

Goal: Identify services and versions running on open ports

Command:

sudo prtip -sS -sV -p 1-1000 192.168.1.10

Expected Output:

PORT    STATE  SERVICE  VERSION
22/tcp  open   ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp  open   http     Apache httpd 2.4.52 ((Ubuntu))
443/tcp open   https    Apache httpd 2.4.52 ((Ubuntu))
3306/tcp open  mysql    MySQL 8.0.33-0ubuntu0.22.04.2

Interpretation:

• OpenSSH 8.9p1: SSH server version
• Apache 2.4.52: Web server version
• MySQL 8.0.33: Database version
• Ubuntu Linux: Operating system hint

Use Case:

• Vulnerability assessment (check for outdated versions)
• Inventory management (document server configurations)

Intensity Levels

Basic Service Detection:

sudo prtip -sS -sV -p 1-1000 192.168.1.1

Intensity Levels (0-9):

sudo prtip -sS -sV --version-intensity 5 -p 80,443 192.168.1.1
# Higher intensity = more probes, more accurate, slower

Aggressive Detection (OS + Service + Scripts):

sudo prtip -A -p 1-1000 192.168.1.1
# Equivalent to: -sV -O -sC --traceroute

OS Fingerprinting

Goal: Determine operating system of target

Command:

sudo prtip -sS -O -p 1-1000 192.168.1.10

Expected Output:

OS Detection Results:
OS: Linux 5.15 - 6.1 (Ubuntu 22.04)
Confidence: 95%
CPE: cpe:/o:canonical:ubuntu_linux:22.04

Interpretation:

• OS: Linux kernel 5.15-6.1
• Distribution: Ubuntu 22.04
• Confidence: 95% (high confidence)

Use Case:

• Network inventory
• Vulnerability scanning (OS-specific exploits)
• Compliance checks

Batch Scanning

Goal: Scan multiple targets from file

Command:

sudo prtip -sS -p 80,443 -iL targets.txt -oA batch_results

targets.txt:

192.168.1.10
192.168.1.20
10.0.0.0/24
example.com

Output:

• batch_results.txt (normal output)
• batch_results.json (JSON)
• batch_results.xml (XML)
• batch_results.gnmap (greppable)

Best Practices

1. Start with Host Discovery

Before scanning ports, discover which hosts are alive:

# Host discovery (no port scan)
sudo prtip -sn 192.168.1.0/24 -oN live-hosts.txt

# Review live hosts
cat live-hosts.txt

# Then scan only live hosts
sudo prtip -sS -p 1-1000 -iL live-hosts.txt

Time Savings:

• If 20 out of 256 hosts are live: 92% faster (scan 20 instead of 256)
• Reduces network noise

2. Limit Scan Scope

Scan only what you need:

# Scan specific ports
prtip -sS -p 22,80,443,3389 TARGET

# Scan port range
prtip -sS -p 1-1000 TARGET

# Scan all ports (warning: very slow)
prtip -sS -p 1-65535 TARGET  # or -p-

Port Selection Tips:

• Web services: 80, 443, 8080, 8443
• Remote access: 22 (SSH), 3389 (RDP), 23 (Telnet)
• Databases: 3306 (MySQL), 5432 (PostgreSQL), 1433 (MSSQL)
• Mail: 25 (SMTP), 110 (POP3), 143 (IMAP), 587 (SMTP TLS)
• File sharing: 445 (SMB), 21 (FTP), 22 (SFTP)

3. Get Permission First

Legal Requirements:

• ✅ Scan your own networks
• ✅ Scan with explicit written permission
• ✅ Use authorized test targets (e.g., scanme.nmap.org)
• ❌ NEVER scan without permission (violates CFAA, CMA, and similar laws)

Authorized Test Targets:

• scanme.nmap.org - Nmap's official test server
• Your own machines/networks
• Penetration testing labs (HackTheBox, TryHackMe)
• Explicitly authorized targets during engagements

Common Mistakes

Mistake 1: Forgetting sudo for SYN Scan

Wrong:

prtip -sS -p 80,443 192.168.1.1
# Error: Permission denied

Correct:

sudo prtip -sS -p 80,443 192.168.1.1

Mistake 2: Scanning Without Permission

Wrong:

sudo prtip -sS -p 1-65535 8.8.8.8
# Illegal: Scanning Google DNS without permission

Correct:

# Only scan networks you own or have written permission to test
sudo prtip -sS -p 1-1000 scanme.nmap.org  # Nmap provides this for testing

Mistake 3: Using Wrong Port Syntax

Wrong:

sudo prtip -sS -p 80-443 192.168.1.1
# This scans ports 80 to 443 (364 ports), not just 80 and 443

Correct:

sudo prtip -sS -p 80,443 192.168.1.1
# Scan only ports 80 and 443

Real-World Examples

Example 1: Home Network Audit

Objective: Identify all devices and services on your home network

# Step 1: Find your network range
ip addr show | grep "inet 192.168"
# Example output: inet 192.168.1.100/24

# Step 2: Discover live hosts
sudo prtip -sn 192.168.1.0/24 -oN home-hosts.txt

# Step 3: Fast scan of live hosts
sudo prtip -F -iL home-hosts.txt -oN home-services.txt

# Step 4: Review results
cat home-services.txt

What You'll Find:

• Router: Ports 80, 443 (web interface)
• Smart devices: Various ports
• Computers: 22 (SSH), 3389 (RDP), 445 (SMB)
• Printers: 9100, 631

Example 2: Web Server Health Check

Objective: Verify web server is running and identify version

# Quick check
prtip -sS -p 80,443 www.example.com

# Detailed check with service detection
sudo prtip -sV -p 80,443,8080,8443 www.example.com

# With TLS certificate info
sudo prtip -sV -p 443 --script=ssl-cert www.example.com

What You'll Learn:

• Which ports are open (80, 443, etc.)
• Web server type and version (Apache, Nginx, IIS)
• TLS certificate details (expiration, issuer)

Example 3: Database Server Security Audit

Objective: Check database server exposure

# Scan common database ports
sudo prtip -sV -p 3306,5432,1433,27017 db-server.example.com

# If any are open, investigate further
sudo prtip -sV -p 3306 --script=mysql-info db-server.example.com

Security Checklist:

• ✅ Databases should NOT be exposed to internet
• ✅ Should only be accessible from application servers
• ✅ Should use authentication
• ✅ Should use TLS encryption

Interpreting Results

Port States

open

• Service is actively accepting connections
• Most interesting for penetration testing
• Indicates running service

closed

• Port is accessible but no service running
• Responds with RST packet
• Less interesting but shows host is reachable

filtered

• Firewall or packet filter blocking access
• No response received
• Common on internet-facing hosts

open|filtered

• Cannot determine if open or filtered
• Common with UDP scans
• May need additional probing

Example Scan Result Analysis

PORT     STATE   SERVICE     VERSION
22/tcp   open    ssh         OpenSSH 6.6.1p1 Ubuntu
80/tcp   open    http        Apache httpd 2.4.7
443/tcp  open    ssl/http    Apache httpd 2.4.7
3306/tcp closed  mysql
8080/tcp filtered http-proxy

Analysis:

• Port 22 (SSH): OpenSSH 6.6.1p1 - OUTDATED (2014, known vulnerabilities)
• Port 80/443 (HTTP/HTTPS): Apache 2.4.7 - OUTDATED (2013, multiple CVEs)
• Port 3306 (MySQL): Closed - Good (not exposed)
• Port 8080: Filtered - May be behind firewall

Action Items:

1. Update OpenSSH to version 8.0+ immediately
2. Update Apache to 2.4.41+ (current stable)
3. Investigate port 8080 filtering rules
4. Consider disabling SSH password authentication (use keys)

Quick Reference

Essential Commands

# Basic Scans
prtip -sT -p 80,443 TARGET          # TCP Connect (no root)
sudo prtip -sS -p 1-1000 TARGET     # SYN scan (stealth)
sudo prtip -sU -p 53,161 TARGET     # UDP scan

# Service Detection
sudo prtip -sS -sV -p 1-1000 TARGET              # Version detection
sudo prtip -sS -O -p 1-1000 TARGET               # OS detection
sudo prtip -A -p 1-1000 TARGET                   # Aggressive (all)

# Output
sudo prtip -sS -p 80,443 TARGET -oN results.txt  # Normal
sudo prtip -sS -p 80,443 TARGET -oJ results.json # JSON
sudo prtip -sS -p 80,443 TARGET -oA results      # All formats

Common Port Reference

Next Steps

• Learn Scan Types - TCP, UDP, stealth scanning techniques
• Master Timing & Performance - Optimize scan speed
• Explore Output Formats - JSON, XML, Greppable formats
• Advanced Usage - IPv6, plugins, automation

See Also:

• Quick Start Guide
• Tutorials
• Examples Gallery

Scan Types

ProRT-IP supports 8 scan types covering TCP, UDP, stealth scanning, and advanced anonymity techniques.

Overview

TCP Connect Scan (-sT)

How It Works

1. Completes full TCP three-way handshake
2. Establishes real connection
3. Immediately closes connection

Diagram:

Scanner                  Target
   |                        |
   |-------- SYN --------->|
   |<------- SYN-ACK ------|  (port open)
   |-------- ACK --------->|
   |-------- RST --------->|  (close connection)

Advantages

• No Privileges Required: Works without root/administrator access
• 100% Accuracy: Real connection test (vs 95% for SYN scan)
• Universal Compatibility: Works on all platforms
• Reliable: Not affected by packet filtering

Disadvantages

• Slower: Full handshake overhead (vs half-open SYN)
• Always Logged: Target always logs connection attempts
• Easier Detection: Firewall/IDS easily identify connection patterns
• More Overhead: More packets exchanged per port

Usage

# Basic TCP Connect scan (no root required)
prtip -sT -p 80,443 192.168.1.1

# Scan multiple ports
prtip -sT -p 1-1000 example.com

# From file without root
prtip -sT -p 22,80,443 -iL targets.txt

When to Use

• You don't have root/administrator access
• Need 100% accurate results
• Testing application-layer availability
• Network policy prohibits raw packet manipulation
• Target firewall blocks SYN scans

Expected Output:

PORT    STATE  SERVICE
22/tcp  open   ssh
80/tcp  open   http
443/tcp open   https
3306/tcp closed mysql

TCP SYN Scan (-sS)

How It Works

1. Sends SYN packet (TCP handshake step 1)
2. Target responds with SYN-ACK if port is open
3. Scanner sends RST (doesn't complete handshake)

Diagram:

Scanner                  Target
   |                        |
   |-------- SYN --------->|
   |<------- SYN-ACK ------|  (port open, step 2)
   |-------- RST --------->|  (abort, don't complete)
   |                        |

Advantages

• Fast: Half-open connection (no full handshake overhead)
• Stealthy: May not be logged by target (incomplete connection)
• 95% Accuracy: Reliable for most scenarios
• Default Choice: Industry standard for network scanning
• Lower Overhead: Fewer packets than Connect scan

Disadvantages

• Requires Root: Needs raw packet privileges
• Some Firewalls Detect: Modern IDS/IPS may identify SYN scans
• Platform Issues: Windows/Cisco firewalls may behave differently
• Not 100% Accurate: Some edge cases (stateful firewalls)

Usage

# Basic SYN scan (requires root)
sudo prtip -sS -p 80,443 192.168.1.1

# Scan port range
sudo prtip -sS -p 1-1000 192.168.1.1

# Fast scan (top 100 ports)
sudo prtip -sS -F 192.168.1.1

# All ports
sudo prtip -sS -p- 192.168.1.1

When to Use

• Default choice for 95% of scanning scenarios
• You have root/administrator access
• Need balance between speed and stealth
• Target doesn't have advanced IDS/IPS
• Large-scale network scanning

Expected Output:

PORT     STATE   SERVICE
22/tcp   open    ssh
80/tcp   open    http
443/tcp  open    https
3306/tcp closed  mysql
8080/tcp filtered http-proxy

UDP Scan (-sU)

How It Works

1. Sends UDP packet to target port
2. Waits for response or ICMP Port Unreachable
3. No response = open|filtered (uncertain)
4. Response = open
5. ICMP Port Unreachable = closed

Diagram:

Scanner                  Target
   |                        |
   |------- UDP Probe ---->|
   |                        |  (no response)
   |                        |
   (wait timeout)          |
   |                        |
Result: open|filtered      |

Advantages

• Discovers UDP Services: Only way to find DNS, SNMP, NTP, etc.
• Critical Services: Many important services use UDP
• Protocol Payloads: ProRT-IP sends protocol-specific probes for accuracy

Disadvantages

• Very Slow: 10-100x slower than TCP (ICMP rate limiting)
• Less Accurate: 80% vs 95% for TCP (many uncertain results)
• Requires Root: Raw packet privileges needed
• Network Dependent: Performance varies by network/firewall

Usage

# Scan common UDP services
sudo prtip -sU -p 53,161,123 192.168.1.10

# Scan specific UDP ports
sudo prtip -sU -p 67,68,137,138,514 192.168.1.10

# Combined TCP + UDP scan
sudo prtip -sS -sU -p 1-100 192.168.1.10

Common UDP Services

When to Use

• Need complete network inventory
• Scanning DNS, SNMP, or other UDP services
• Compliance requirements (must scan all protocols)
• Network troubleshooting (identify UDP services)

Expected Output:

PORT     STATE         SERVICE
53/udp   open          dns
161/udp  open          snmp
123/udp  open|filtered ntp
514/udp  open|filtered syslog

Note: UDP scans are slow. Port 53 scan may take 30-60 seconds vs 1-2 seconds for TCP.

Stealth Scans (FIN, NULL, Xmas)

Overview

Stealth scans exploit TCP RFC 793 to evade simple packet filters. They send unusual flag combinations:

How They Work:

• Closed ports: Should respond with RST
• Open ports: No response (RFC 793 behavior)
• Filtered: No response or ICMP unreachable

FIN Scan (-sF)

Sends packets with only FIN flag set.

# FIN scan (evade simple firewalls)
sudo prtip -sF -p 80,443 192.168.1.10

# Combined with slow timing
sudo prtip -sF -T0 -p 80,443 192.168.1.10

Expected Output:

PORT    STATE         SERVICE
80/tcp  open|filtered http
443/tcp open|filtered https
22/tcp  closed        ssh

NULL Scan (-sN)

Sends packets with no flags set (all zero).

# NULL scan
sudo prtip -sN -p 80,443 192.168.1.10

Xmas Scan (-sX)

Sends packets with FIN, PSH, and URG flags set ("lit up like a Christmas tree").

# Xmas scan
sudo prtip -sX -p 80,443 192.168.1.10

Advantages

• Evade Simple Firewalls: Some packet filters only check SYN flag
• Stealthy: Unusual traffic may bypass detection
• RFC 793 Compliant: Works against compliant TCP stacks

Disadvantages

• Unreliable on Windows: Windows ignores these packets
• Unreliable on Cisco: Some Cisco devices don't follow RFC 793
• Modern Firewalls Detect: Stateful firewalls catch these easily
• Less Accurate: More open|filtered results (uncertain)

When to Use

• Not Recommended for Modern Networks: Most firewalls now stateful
• Evading legacy firewall rules
• Penetration testing (demonstrate bypass)
• Academic/research purposes

Note: These scans are largely obsolete due to stateful firewalls. Use SYN scan for modern networks.

ACK Scan (-sA)

How It Works

Sends ACK packets (normally part of established connection). Used to map firewall rules, not discover open ports.

Diagram:

Scanner                  Target/Firewall
   |                        |
   |-------- ACK --------->|
   |<------- RST --------| (unfiltered)
   |                        |
   (no response = filtered)

Usage

# Firewall rule mapping
sudo prtip -sA -p 80,443,22,25 192.168.1.10

Expected Output:

PORT   STATE
80/tcp unfiltered   # Firewall allows traffic
443/tcp unfiltered  # Firewall allows traffic
22/tcp filtered     # Firewall blocks SSH
25/tcp filtered     # Firewall blocks SMTP

Interpretation

• Unfiltered: Port is accessible (firewall allows)
• Filtered: Port is blocked by firewall
• Does NOT indicate open/closed: Only shows firewall rules

When to Use

• Mapping firewall rules
• Identifying which ports are filtered
• Understanding network security posture
• Compliance testing (verify firewall configuration)

Use Case Example:

# Test firewall allows web traffic
sudo prtip -sA -p 80,443 192.168.1.10

# If unfiltered, then test actual port state
sudo prtip -sS -p 80,443 192.168.1.10

Idle/Zombie Scan (-sI)

Overview

Maximum anonymity scan: Target never sees your IP address. Uses intermediary "zombie" host with predictable IP ID sequence.

How It Works

1. Find Zombie: Discover host with incremental IP ID
2. Baseline: Check zombie's current IP ID
3. Probe: Spoof packet from zombie to target
4. Check: Measure zombie's IP ID increment
   • Increment +2: Port open (zombie received SYN-ACK from target)
   • Increment +1: Port closed (no response to zombie)

Diagram:

Your IP         Zombie Host         Target
   |                |                  |
   |-- Probe 1 ---->|                  |
   |<-- IPID 100 ---|                  |
   |                |                  |
   |-- Spoof ------>|                  |
   |                |-- SYN (spoofed)->|
   |                |<---- SYN-ACK ----|  (port open)
   |                |-- RST ---------->|
   |                |                  |
   |-- Probe 2 ---->|                  |
   |<-- IPID 102 ---|                  |
   |                |                  |
   (IPID +2 = port open)

Usage

# Discover suitable zombie hosts
sudo prtip -sI RND 192.168.1.0/24

# Use specific zombie
sudo prtip -sI 192.168.1.5 -p 80,443 TARGET

# Idle scan with verbose output
sudo prtip -sI 192.168.1.5 -p 80,443 -v TARGET

Finding Zombie Hosts

Requirements:

• Idle (low network traffic)
• Incremental IP ID sequence
• Not behind firewall that blocks spoofed packets

Automatic Discovery:

# Scan network for suitable zombies
sudo prtip -sI RND 192.168.1.0/24

# Output:
# [✓] Found zombie: 192.168.1.5 (idle, incremental IPID)
# [✓] Found zombie: 192.168.1.42 (idle, incremental IPID)
# [✗] Rejected: 192.168.1.10 (busy)
# [✗] Rejected: 192.168.1.15 (random IPID)

Advantages

• Maximum Anonymity: Target never sees your IP
• Bypass IP-based Filters: Target logs zombie IP, not yours
• Stealth: No direct connection to target
• Unique Technique: Few scanners support this

Disadvantages

• Very Slow: 500-800ms per port (vs 1-2ms for SYN)
• Requires Suitable Zombie: Not always available
• Complex: Requires understanding of IP ID behavior
• 99.5% Accuracy: Slightly less accurate than SYN (rare edge cases)

When to Use

• Penetration Testing: Demonstrate advanced stealth
• Anonymity Required: Hide your IP from target logs
• Bypassing IP Filters: Target blocks your IP
• Research/Academic: Study IP ID behavior

Ethical Note: Only use on authorized targets. Zombie host owner may be implicated.

See Also:

• Idle Scan Guide - Complete technical reference
• Tutorial: Advanced Stealth - Hands-on walkthrough

Port Scanning Techniques

Common Ports (Fast)

Goal: Quickly identify common services

sudo prtip -sS -F 192.168.1.10

Explanation:

• -F: Fast scan (top 100 ports)
• Completes in 2-5 seconds
• Covers 90% of real-world services

When to Use:

• Initial reconnaissance
• Quick network checks
• Time-constrained situations

Expected Output:

PORT    STATE  SERVICE
22/tcp  open   ssh
80/tcp  open   http
443/tcp open   https
3306/tcp open  mysql

Full Port Scan

Goal: Comprehensive scan of all 65,535 ports

sudo prtip -sS -p- -T4 192.168.1.10 -oN fullscan.txt

Explanation:

• -p-: All ports (1-65535)
• -T4: Aggressive timing (faster)
• -oN fullscan.txt: Save results

Duration: 5-30 minutes depending on network and timing template

When to Use:

• Security audit (find all services)
• Non-standard port discovery
• Complete inventory required
• Compliance requirements

Custom Port List

Goal: Scan specific ports of interest

sudo prtip -sS -p 80,443,8080,8443,3000,3306 192.168.1.10

Explanation:

• Web ports: 80, 443, 8080, 8443, 3000
• Database port: 3306 (MySQL)

Port Selection by Category:

Web Services:

prtip -sS -p 80,443,8080,8443,3000,8000 TARGET

Databases:

prtip -sS -p 3306,5432,1433,27017,6379,1521 TARGET

Remote Access:

prtip -sS -p 22,23,3389,5900,5901 TARGET

Mail Services:

prtip -sS -p 25,110,143,465,587,993,995 TARGET

File Sharing:

prtip -sS -p 21,22,445,139,2049 TARGET

Stealth Scanning Techniques

Slow Timing (T0)

Goal: Evade intrusion detection systems (IDS)

sudo prtip -sS -T0 -p 80,443,22 192.168.1.10

Explanation:

• -T0: Paranoid timing (5-minute delays between packets)
• Very slow but stealthy
• Avoids rate-based IDS triggers

Duration: Hours for small port ranges

Fragmentation

Goal: Evade simple packet filters

sudo prtip -sS -f -p 80,443 192.168.1.10

Explanation:

• -f: Fragment packets into small pieces
• Some firewalls can't reassemble/inspect fragments
• Modern stateful firewalls defeat this

Decoy Scanning

Goal: Hide your real IP among fake sources

sudo prtip -sS -D RND:10 -p 80,443 192.168.1.10

Explanation:

• -D RND:10: Use 10 random decoy IPs
• Target sees scan from multiple sources
• Your real IP hidden in noise

Expected Output:

Using decoys: 203.0.113.15, 198.51.100.42, ..., YOUR_IP, ...
Scanning 192.168.1.10...
PORT    STATE  SERVICE
80/tcp  open   http
443/tcp open   https

Combined Evasion

Maximum stealth - combine multiple techniques:

sudo prtip -sS -T1 -f --ttl 64 -D RND:5 -p 80,443 192.168.1.10

Explanation:

• -T1: Sneaky timing
• -f: Fragmentation
• --ttl 64: Custom TTL (mimic different OS)
• -D RND:5: 5 random decoy IPs

Use Case: Maximum stealth for penetration testing

Multiple Scan Types

Goal: Combine TCP SYN and UDP scanning

sudo prtip -sS -sU -p 1-100 192.168.1.10

Explanation:

• Scans TCP ports 1-100 with SYN scan
• Scans UDP ports 1-100 with UDP scan
• Comprehensive coverage (all protocols)

Duration: UDP is slow (10-100x slower than TCP)

When to Use:

• Complete network inventory
• Compliance requirements (scan all protocols)
• Identify both TCP and UDP services

Best Practices

1. Start with Host Discovery

Before scanning ports, discover which hosts are alive:

# Host discovery (no port scan)
sudo prtip -sn 192.168.1.0/24 -oN live-hosts.txt

# Review live hosts
cat live-hosts.txt

# Then scan only live hosts
sudo prtip -sS -p 1-1000 -iL live-hosts.txt

Time Savings:

• If 20 out of 256 hosts are live: 92% faster (scan 20 instead of 256)
• Reduces network noise

2. Choose Appropriate Scan Type

3. Get Permission First

Legal Requirements:

• ✅ Scan your own networks
• ✅ Scan with explicit written permission
• ✅ Use authorized test targets (e.g., scanme.nmap.org)
• ❌ NEVER scan without permission (violates CFAA, CMA, and similar laws)

Authorized Test Targets:

• scanme.nmap.org - Nmap's official test server
• Your own machines/networks
• Penetration testing labs (HackTheBox, TryHackMe)
• Explicitly authorized targets during engagements

Common Mistakes

Mistake 1: Forgetting sudo for SYN Scan

Wrong:

prtip -sS -p 80,443 192.168.1.1
# Error: Permission denied

Correct:

sudo prtip -sS -p 80,443 192.168.1.1

Mistake 2: Using Stealth Scans on Modern Networks

Wrong:

sudo prtip -sF -p 80,443 192.168.1.1
# Modern stateful firewall detects this

Correct:

sudo prtip -sS -p 80,443 192.168.1.1
# Use SYN scan for modern networks

Mistake 3: Not Accounting for UDP Slowness

Wrong:

sudo prtip -sU -p- 192.168.1.1
# This will take DAYS

Correct:

sudo prtip -sU -p 53,161,123,514 192.168.1.1
# Scan only essential UDP ports

Interpreting Results

Port States

open

• Service is actively accepting connections
• Most interesting for penetration testing
• Indicates running service

closed

• Port is accessible but no service running
• Responds with RST packet
• Less interesting but shows host is reachable

filtered

• Firewall or packet filter blocking access
• No response received
• Common on internet-facing hosts

open|filtered

• Cannot determine if open or filtered
• Common with UDP scans and stealth scans
• May need additional probing

Example Analysis:

PORT     STATE         SERVICE
22/tcp   open          ssh         # ✅ SSH running
80/tcp   open          http        # ✅ Web server
443/tcp  open          https       # ✅ HTTPS server
3306/tcp closed        mysql       # ❌ MySQL not running
8080/tcp filtered      http-proxy  # 🔒 Firewall blocking
9200/tcp open|filtered http        # ❓ Uncertain (needs investigation)

Quick Reference

Essential Commands

# Basic Scans
prtip -sT -p 80,443 TARGET          # TCP Connect (no root)
sudo prtip -sS -p 1-1000 TARGET     # SYN scan (stealth)
sudo prtip -sU -p 53,161 TARGET     # UDP scan

# Stealth
sudo prtip -sF -p 80,443 TARGET     # FIN scan
sudo prtip -sN -p 80,443 TARGET     # NULL scan
sudo prtip -sX -p 80,443 TARGET     # Xmas scan
sudo prtip -sA -p 80,443 TARGET     # ACK scan (firewall)
sudo prtip -sI ZOMBIE -p 80 TARGET  # Idle scan (anonymous)

# Port Ranges
sudo prtip -sS -F TARGET            # Fast (top 100)
sudo prtip -sS -p- TARGET           # All ports
sudo prtip -sS -p 1-1000 TARGET     # Custom range

Common Port Reference

Next Steps

• Timing & Performance - Optimize scan speed
• Service Detection - Identify versions
• Advanced Usage - IPv6, plugins, automation
• Examples Gallery - Runnable examples

See Also:

• Tutorial: Understanding Scan Types
• Stealth Scanning Guide
• Idle Scan Technical Reference

CLI Reference

Complete command-line interface reference for ProRT-IP.

Synopsis

prtip [OPTIONS] <target>...

Target Specification

IP Addresses

prtip 192.168.1.1                    # Single IP
prtip 192.168.1.1 192.168.1.10       # Multiple IPs
prtip 192.168.1.0/24                 # CIDR notation
prtip 10.0.0.0/8                     # Large subnet

IPv6 Addresses

prtip 2001:db8::1                    # IPv6 literal
prtip 2001:db8::/64                  # IPv6 CIDR
prtip -6 example.com                 # Force IPv6 resolution

Hostnames

prtip example.com                    # Single hostname
prtip example.com target.local       # Multiple hostnames

Port Specification

Basic Port Syntax

-p, --ports <PORTS>                  # Specify ports to scan

Examples:

prtip -p 80 target.com               # Single port
prtip -p 80,443,8080 target.com      # Port list
prtip -p 1-1000 target.com           # Port range
prtip -p 22,80,443,8000-9000 target.com  # Mixed
prtip -p- target.com                 # All 65535 ports

Top Ports

-F                                   # Fast scan (top 100 ports)
--top-ports <N>                      # Scan top N ports

Examples:

prtip -F target.com                  # Top 100 ports
prtip --top-ports 1000 target.com    # Top 1000 ports

Scan Types

TCP Scans

-sS, --scan-type syn                 # TCP SYN scan (default with sudo)
-sT, --scan-type connect             # TCP Connect scan (default)
-sF, --scan-type fin                 # TCP FIN scan
-sN, --scan-type null                # TCP NULL scan
-sX, --scan-type xmas                # TCP Xmas scan
-sA, --scan-type ack                 # TCP ACK scan (firewall detection)

UDP Scans

-sU, --scan-type udp                 # UDP scan

Idle Scan

-sI, --scan-type idle --zombie <IP>  # Idle/zombie scan

Examples:

sudo prtip -sS -p 80,443 target.com
prtip -sT -p 22-25 target.com
sudo prtip -sU -p 53,161 target.com
sudo prtip -sI --zombie 192.168.1.5 -p 80 target.com

Detection Options

Service Detection

-sV, --service-detection             # Enable service detection
--version-intensity <0-9>            # Detection intensity (default: 5)

Examples:

prtip -sV -p 22,80,443 target.com
prtip -sV --version-intensity 9 target.com  # Maximum intensity

OS Fingerprinting

-O, --os-detect                      # Enable OS detection

Example:

sudo prtip -O target.com

TLS Certificate Analysis

--tls-cert                           # Analyze TLS certificates
--sni <hostname>                     # SNI hostname for TLS

Example:

prtip --tls-cert -p 443 target.com

Aggressive Mode

-A                                   # Enable all detection (-O -sV --progress)

Example:

sudo prtip -A target.com

Timing Options

Timing Templates

-T<0-5>                              # Timing template

Templates:

Examples:

prtip -T0 target.com                 # Paranoid mode
prtip -T4 target.com                 # Aggressive (default)
prtip -T5 target.com                 # Insane speed

Performance Options

--timeout <MS>                       # Connection timeout (ms)
--max-concurrent <N>                 # Maximum concurrent connections
--host-delay <MS>                    # Delay between probes (ms)

Examples:

prtip --timeout 5000 target.com
prtip --max-concurrent 1000 target.com
prtip --host-delay 100 target.com

Rate Limiting

--rate-limit <PPS>                   # Maximum packets per second
--burst <N>                          # Burst size (default: 100)

Examples:

prtip --rate-limit 1000 target.com
prtip --rate-limit 500 --burst 50 target.com

Output Options

Output Formats

-oN <FILE>                           # Normal text output
-oX <FILE>                           # XML output
-oG <FILE>                           # Greppable output
-oA <BASENAME>                       # All formats
--output <FORMAT>                    # Manual format specification
--output-file <FILE>                 # Output file path

Formats:

• text - Human-readable text
• json - JSON format
• xml - XML format (nmap-compatible)
• greppable - Greppable format

Examples:

prtip -oN results.txt target.com
prtip -oX results.xml target.com
prtip -oG results.gnmap target.com
prtip -oA scan-results target.com   # Creates .txt, .xml, .gnmap
prtip --output json --output-file results.json target.com

Database Storage

--db <PATH>                          # SQLite database path

Example:

prtip --db scans.db target.com

PCAP Output

--pcap <FILE>                        # PCAPNG packet capture

Example:

sudo prtip --pcap capture.pcapng -sS target.com

Verbosity & Progress

Verbosity Levels

-v                                   # Increase verbosity (info)
-vv                                  # More verbosity (debug)
-vvv                                 # Maximum verbosity (trace)
-q, --quiet                          # Quiet mode (errors only)

Progress Display

--progress                           # Show progress bar
--live                               # Live TUI dashboard

Examples:

prtip -v -p 80,443 target.com
prtip --progress -p- target.com
prtip --live -p 1-10000 target.com/24

Evasion Techniques

Packet Fragmentation

-f                                   # Fragment packets (8-byte)
--mtu <SIZE>                         # Custom MTU size

Decoy Scanning

-D, --decoys <LIST>                  # Decoy IP addresses

Example:

sudo prtip -D 192.168.1.2,192.168.1.3,ME target.com

Source Port

-g, --source-port <PORT>             # Spoof source port

Example:

sudo prtip -g 53 target.com          # Use DNS source port

TTL Manipulation

--ttl <VALUE>                        # Set packet TTL

Example:

sudo prtip --ttl 32 target.com

Bad Checksum

--badsum                             # Send packets with invalid checksums

Example:

sudo prtip --badsum target.com

Host Discovery

Skip Ping

-Pn, --no-ping                       # Skip host discovery

Example:

prtip -Pn -p 80,443 target.com

IPv6 Options

-6, --ipv6                           # Force IPv6
-4, --ipv4                           # Force IPv4
--prefer-ipv6                        # Prefer IPv6, fallback IPv4
--prefer-ipv4                        # Prefer IPv4, fallback IPv6
--ipv6-only                          # Strict IPv6 mode
--ipv4-only                          # Strict IPv4 mode

Examples:

prtip -6 example.com                 # Force IPv6
prtip --prefer-ipv6 example.com      # Prefer IPv6
prtip 2001:db8::1                    # IPv6 literal

Plugin System

--plugin <PATH>                      # Load Lua plugin
--plugin-arg <KEY=VALUE>             # Plugin argument

Example:

prtip --plugin custom-banner.lua --plugin-arg verbose=true target.com

Miscellaneous

Configuration

--config <FILE>                      # Load configuration file
--template <NAME>                    # Load scan template

Examples:

prtip --config custom.toml target.com
prtip --template aggressive target.com

Help & Version

-h, --help                           # Show help message
-V, --version                        # Show version

Common Command Patterns

Quick Network Scan

prtip -F 192.168.1.0/24

Comprehensive Single Host

sudo prtip -A -p- target.com

Stealth Scan

sudo prtip -sS -T2 --host-delay 100 -p 80,443 target.com

Service Detection

prtip -sV --version-intensity 9 -p 1-10000 target.com

Large-Scale Scan

sudo prtip -sS -p 80,443,8080 --rate-limit 10000 10.0.0.0/8

IPv6 Network Discovery

prtip -6 -F 2001:db8::/64

Database Storage

prtip -sV -p- --db scans.db --output json --output-file results.json target.com

Environment Variables

Exit Codes

See Also

• Basic Usage - Getting started guide
• Scan Types - Detailed scan type documentation
• Output Formats - Output format specifications
• Timing & Performance - Performance tuning guide
• Nmap Compatibility - Nmap flag reference
• Command Reference - Complete flag listing

Output Formats

Learn how to save and process ProRT-IP scan results in multiple formats.

Overview

ProRT-IP supports 5 output formats designed for different use cases:

Text Format (Default)

Purpose: Human-readable terminal output with colorization

Command:

prtip -p 80,443 192.168.1.1
# Output directly to terminal (default)

Save to File:

prtip -p 80,443 192.168.1.1 -oN scan_results.txt

Example Output:

ProRT-IP v0.5.2 - Network Scanner
Starting scan at 2025-11-15 10:30:15

Scanning 192.168.1.1...
PORT     STATE  SERVICE
80/tcp   open   http
443/tcp  open   https

Scan complete: 2 ports scanned in 0.15 seconds
1 host up, 2 ports open

Features:

• Color-coded output (terminal only)
• Human-readable formatting
• Progress indicators
• Summary statistics

Use Cases:

• Interactive terminal sessions
• Quick manual review
• Sharing with non-technical users
• Documentation screenshots

JSON Format

Purpose: Structured data for APIs, modern tooling, and scripting

Command:

prtip -p 80,443 192.168.1.1 -oJ scan_results.json

Example Output:

{
  "scan_metadata": {
    "scanner": "ProRT-IP",
    "version": "0.5.2",
    "start_time": "2025-11-15T10:30:15Z",
    "end_time": "2025-11-15T10:30:16Z",
    "duration_seconds": 0.15,
    "command_line": "prtip -p 80,443 192.168.1.1 -oJ scan_results.json"
  },
  "hosts": [
    {
      "address": "192.168.1.1",
      "state": "up",
      "latency_ms": 2.3,
      "ports": [
        {
          "port": 80,
          "protocol": "tcp",
          "state": "open",
          "service": "http",
          "version": null
        },
        {
          "port": 443,
          "protocol": "tcp",
          "state": "open",
          "service": "https",
          "version": null
        }
      ]
    }
  ],
  "summary": {
    "total_hosts_scanned": 1,
    "hosts_up": 1,
    "total_ports_scanned": 2,
    "ports_open": 2,
    "ports_closed": 0,
    "ports_filtered": 0
  }
}

Parsing with jq:

# Extract all IP addresses with open ports
cat results.json | jq '.hosts[] | select(.state == "up") | .address'
# Output: "192.168.1.1"

# List all open ports
cat results.json | jq '.hosts[].ports[] | select(.state == "open") | .port'
# Output: 80, 443

# Get scan duration
cat results.json | jq '.scan_metadata.duration_seconds'
# Output: 0.15

# Complex query: hosts with SSH (port 22) open
cat results.json | jq '.hosts[] | select(.ports[] | select(.port == 22 and .state == "open")) | .address'

# Export to CSV
cat results.json | jq -r '.hosts[].ports[] | [.port, .protocol, .state, .service] | @csv'

Use Cases:

• API integrations
• CI/CD pipelines
• Automated analysis
• Database imports
• Modern scripting (Python, Node.js)

Advantages:

• Easy to parse (jq, Python json module)
• Structured data (no regex needed)
• Rich metadata
• Widely supported

See Also:

• jq manual
• jq playground

XML Format (Nmap-Compatible)

Purpose: Nmap compatibility and legacy tool integration

Command:

prtip -p 80,443 192.168.1.1 -oX scan_results.xml

Example Output:

<?xml version="1.0" encoding="UTF-8"?>
<nmaprun scanner="ProRT-IP" version="0.5.2" start="1700048415" startstr="2025-11-15 10:30:15">
  <scaninfo type="syn" protocol="tcp" numservices="2" services="80,443"/>
  <host starttime="1700048415" endtime="1700048416">
    <status state="up" reason="syn-ack"/>
    <address addr="192.168.1.1" addrtype="ipv4"/>
    <ports>
      <port protocol="tcp" portid="80">
        <state state="open" reason="syn-ack"/>
        <service name="http" method="table" conf="3"/>
      </port>
      <port protocol="tcp" portid="443">
        <state state="open" reason="syn-ack"/>
        <service name="https" method="table" conf="3"/>
      </port>
    </ports>
    <times srtt="2300" rttvar="500"/>
  </host>
  <runstats>
    <finished time="1700048416" timestr="2025-11-15 10:30:16" elapsed="0.15"/>
    <hosts up="1" down="0" total="1"/>
  </runstats>
</nmaprun>

Parsing with xmllint:

# Extract host IPs
xmllint --xpath '//host/address/@addr' scan_results.xml

# Extract open ports
xmllint --xpath '//port[@protocol="tcp"]/state[@state="open"]/../@portid' scan_results.xml

# Get service names
xmllint --xpath '//port/service/@name' scan_results.xml

Nmap Compatibility:

ProRT-IP's XML format is fully compatible with Nmap XML tools:

# Use with Nmap scripts
prtip -sS -p 1-1000 192.168.1.1 -oX results.xml
nmap --script vuln results.xml  # Analyze with Nmap scripts

# Convert to HTML report
xsltproc scan_results.xml > report.html

# Import into Metasploit
db_import scan_results.xml

Use Cases:

• Nmap tool integration
• XSLT transformations
• Legacy system compatibility
• Metasploit/Burp Suite imports

Greppable Format

Purpose: Shell scripting and line-based processing

Command:

prtip -p 1-1000 192.168.1.0/24 -oG results.gnmap

Example Output:

# ProRT-IP 0.5.2 scan initiated 2025-11-15 10:30:15
Host: 192.168.1.1 ()	Status: Up
Host: 192.168.1.1 ()	Ports: 22/open/tcp//ssh///, 80/open/tcp//http///, 443/open/tcp//https///
Host: 192.168.1.5 ()	Status: Up
Host: 192.168.1.5 ()	Ports: 3306/open/tcp//mysql///, 8080/closed/tcp//http-proxy///
# ProRT-IP done at 2025-11-15 10:30:16 -- 256 IP addresses (2 hosts up) scanned in 0.85 seconds

Format Specification:

Each line follows this structure:

Host: <IP> (<hostname>)  Ports: <port>/<state>/<protocol>//<service>///[, ...]

Parsing with grep:

# Find all hosts with port 22 (SSH) open
grep "22/open" results.gnmap
# Output: Host: 192.168.1.1 ()	Ports: 22/open/tcp//ssh///...

# Count hosts with SSH
grep -c "22/open" results.gnmap
# Output: 1

# Extract only IP addresses with SSH
grep "22/open" results.gnmap | awk '{print $2}'
# Output: 192.168.1.1

# Find hosts with MySQL (port 3306)
grep "3306/open" results.gnmap | awk '{print $2}'

# List all unique open ports
grep "Ports:" results.gnmap | grep -oP '\d+/open' | cut -d'/' -f1 | sort -n | uniq

Parsing with awk:

# Extract IP and open ports
awk '/Ports:/ {
  ip=$2;
  for(i=4; i<=NF; i++) {
    if($i ~ /open/) {
      split($i, port, "/");
      print ip, port[1], port[5];
    }
  }
}' results.gnmap

# Count open ports per host
awk '/Ports:/ {
  ip=$2;
  count=0;
  for(i=4; i<=NF; i++) {
    if($i ~ /open/) count++;
  }
  print ip, count;
}' results.gnmap

Use Cases:

• Shell scripting (bash, zsh)
• Quick grep/awk processing
• Legacy Nmap workflows
• Log analysis
• Simple automation

Advantages:

• One line per host (easy to grep)
• Fast processing (no parsing libraries needed)
• Portable (works on any Unix system)
• Compact format

PCAPNG Format (Packet Capture)

Purpose: Detailed packet analysis and forensics

Command:

sudo prtip -sS -p 80,443 192.168.1.1 --pcap capture.pcapng

Example Output:

PCAPNG files contain raw packet data captured during the scan. Open with Wireshark:

# View with Wireshark
wireshark capture.pcapng

# Command-line analysis with tshark
tshark -r capture.pcapng

# Filter SYN packets
tshark -r capture.pcapng -Y "tcp.flags.syn == 1"

# Extract HTTP requests
tshark -r capture.pcapng -Y "http.request"

# Statistics
capinfos capture.pcapng

Wireshark Filters:

# SYN-ACK responses (open ports)
tcp.flags == 0x012

# RST responses (closed ports)
tcp.flags.reset == 1

# ICMP unreachable (filtered)
icmp.type == 3 && icmp.code == 13

# SSL/TLS handshakes
ssl.handshake

Use Cases:

• Deep packet inspection
• Protocol analysis
• Troubleshooting scan issues
• IDS/IPS signature development
• Security research
• Forensic investigation

Advantages:

• Complete packet capture
• Protocol-level analysis
• Timestamp precision (μs)
• Wireshark compatibility

Limitations:

• Large file sizes (1GB+ for extensive scans)
• Requires packet capture privileges (root)
• Not suitable for automation (binary format)

Multiple Output Formats

Save All Formats Simultaneously:

sudo prtip -sS -p 80,443 192.168.1.1 -oA scan_results

Creates:

• scan_results.txt (normal text)
• scan_results.json (JSON)
• scan_results.xml (Nmap XML)
• scan_results.gnmap (greppable)

Use Case:

• Archive complete scan results
• Support multiple analysis workflows
• Share with different teams (JSON for devs, text for management)

Output Processing Examples

Example 1: Extract Web Servers (JSON)

Goal: Find all hosts with HTTP/HTTPS services

# Scan network
sudo prtip -sS -p 80,443,8080,8443 192.168.1.0/24 -oJ scan.json

# Parse JSON: extract IPs with any web port open
cat scan.json | jq -r '
  .hosts[] |
  select(.ports[] | select(
    .port == 80 or .port == 443 or .port == 8080 or .port == 8443
  ) | .state == "open") |
  .address
'
# Output: 192.168.1.1, 192.168.1.10, 192.168.1.20

Example 2: Generate CSV Report (JSON)

Goal: Create spreadsheet-friendly CSV

# Extract: IP, Port, State, Service
cat scan.json | jq -r '
  .hosts[] as $host |
  $host.ports[] |
  [$host.address, .port, .state, .service] |
  @csv
' > report.csv

# Import to spreadsheet (Excel, LibreOffice)

Example 3: Count Open Ports by Service (Greppable)

Goal: Inventory services across network

# Scan
sudo prtip -sS -p 1-1000 192.168.1.0/24 -oG scan.gnmap

# Count by service
grep "Ports:" scan.gnmap | \
  grep -oP '\d+/open/\w+//\w+' | \
  cut -d'/' -f5 | \
  sort | uniq -c | sort -nr

# Output:
# 45 http
# 23 ssh
# 12 https
# 8 mysql
# 3 smtp

Example 4: Compare Two Scans (JSON)

Goal: Find new/closed ports between scans

# Baseline scan
sudo prtip -sS -p 1-1000 192.168.1.1 -oJ baseline.json

# Current scan
sudo prtip -sS -p 1-1000 192.168.1.1 -oJ current.json

# Find new open ports (jq)
diff \
  <(cat baseline.json | jq '.hosts[].ports[] | select(.state == "open") | .port' | sort) \
  <(cat current.json | jq '.hosts[].ports[] | select(.state == "open") | .port' | sort)

# Output: > 3306  (MySQL newly opened)

Example 5: Filter by Port State (XML)

Goal: Extract only filtered ports (firewalled)

# Scan
sudo prtip -sA -p 1-1000 192.168.1.1 -oX scan.xml

# Extract filtered ports
xmllint --xpath '//port/state[@state="filtered"]/../@portid' scan.xml | \
  grep -oP '\d+' | \
  sort -n

Example 6: Automated Vulnerability Check (JSON)

Goal: Alert on outdated service versions

# Scan with service detection
sudo prtip -sS -sV -p 22,80,443 192.168.1.1 -oJ scan.json

# Check for vulnerable versions (example: OpenSSH < 8.0)
cat scan.json | jq '
  .hosts[].ports[] |
  select(.service == "ssh" and .version != null) |
  select(.version | test("OpenSSH [0-7]\\.[0-9]")) |
  "⚠️ Vulnerable SSH: " + .version
'

Format Selection Guide

When to Use Each Format

Text (-oN):

• ✅ Interactive terminal sessions
• ✅ Quick manual review
• ✅ Non-technical stakeholders
• ❌ Automated processing

JSON (-oJ):

• ✅ API integrations
• ✅ Modern scripting (Python, Node.js)
• ✅ CI/CD pipelines
• ✅ Database imports
• ❌ Human reading (too verbose)

XML (-oX):

• ✅ Nmap tool compatibility
• ✅ Metasploit/Burp imports
• ✅ XSLT transformations
• ❌ Modern APIs (JSON preferred)

Greppable (-oG):

• ✅ Shell scripting
• ✅ Quick grep/awk analysis
• ✅ Legacy workflows
• ❌ Complex data structures

PCAPNG (--pcap):

• ✅ Protocol analysis
• ✅ Troubleshooting
• ✅ Security research
• ❌ General reporting (too low-level)

Performance Considerations

File Sizes

Approximate sizes for 1,000 ports scanned on 100 hosts:

I/O Optimization

Large Scans (10K+ hosts):

# Stream to file (avoid memory buffering)
sudo prtip -sS -p 80,443 10.0.0.0/16 -oJ results.json &
tail -f results.json | jq .  # Monitor in real-time

# Compress output
sudo prtip -sS -p- 192.168.1.0/24 -oJ scan.json
gzip scan.json  # 60-80% size reduction

Network Shares:

# Avoid writing to network shares during scan (slow)
# Write locally, then copy
sudo prtip -sS -p 1-1000 192.168.1.0/24 -oA /tmp/scan
rsync -avz /tmp/scan.* server:/backup/

Best Practices

1. Always Save Results

# Bad: No output saved
sudo prtip -sS -p 80,443 192.168.1.1

# Good: Save for later analysis
sudo prtip -sS -p 80,443 192.168.1.1 -oA scan-$(date +%Y%m%d)

2. Use Descriptive Filenames

# Include: date, target, purpose
sudo prtip -sS -p 1-1000 web-server.example.com \
  -oA webserver-audit-$(date +%Y%m%d-%H%M)

3. Combine Formats for Different Audiences

# JSON for automation, text for stakeholders
sudo prtip -sS -p 1-1000 192.168.1.0/24 -oA scan
cat scan.txt | mail -s "Scan Report" manager@example.com
python3 process_scan.py scan.json  # Automated analysis

4. Validate JSON Output

# Check JSON syntax after scan
cat scan.json | jq . > /dev/null
echo $?  # 0 = valid JSON, non-zero = error

5. Archive with Metadata

# Create scan archive
mkdir scan-archive-$(date +%Y%m%d)
sudo prtip -sS -p 1-1000 192.168.1.0/24 -oA scan-archive-$(date +%Y%m%d)/scan
echo "Scan: 192.168.1.0/24, Ports: 1-1000, Date: $(date)" > scan-archive-$(date +%Y%m%d)/README.txt
tar czf scan-archive-$(date +%Y%m%d).tar.gz scan-archive-$(date +%Y%m%d)/

Troubleshooting

Issue: JSON Parsing Errors

Error:

parse error: Expected separator between values at line 45

Cause: Incomplete JSON (scan interrupted)

Solution:

# Ensure scan completes
sudo prtip -sS -p 80,443 192.168.1.1 -oJ scan.json
echo $?  # Check exit code (0 = success)

# Validate JSON
cat scan.json | jq . > /dev/null

Issue: Large Output Files

Problem: PCAPNG file 10GB+

Solution:

# Limit packet capture
sudo prtip -sS -p 80,443 192.168.1.0/24 --pcap scan.pcapng --snaplen 96
# snaplen=96: Capture only headers (no payload)

# Disable PCAPNG for large scans
sudo prtip -sS -p 80,443 192.168.1.0/24 -oJ scan.json
# Use JSON/XML/Greppable for large networks

Issue: Permission Denied Writing Output

Error:

Error: Permission denied writing to /var/log/scan.json

Solution:

# Write to user-writable directory
sudo prtip -sS -p 80,443 192.168.1.1 -oJ ~/scans/scan.json

# Or use sudo for privileged paths
sudo prtip -sS -p 80,443 192.168.1.1 -oJ /var/log/scan.json

Next Steps

• Advanced Usage - Complex scanning scenarios
• Examples Gallery - 65 runnable examples
• Tutorials - Interactive walkthroughs

See Also:

• Output Formats (32-USER-GUIDE.md)
• Output Processing (32-USER-GUIDE.md)
• Batch Scanning

Configuration

ProRT-IP supports multiple configuration methods: configuration files, environment variables, and scan templates. Command-line flags take precedence over all other configuration sources.

Configuration Files

Location Hierarchy

ProRT-IP searches for configuration files in the following order (highest to lowest priority):

1. ./prtip.toml - Current directory (project-specific config)
2. ~/.config/prtip/config.toml - User configuration
3. /etc/prtip/config.toml - System-wide configuration

Creating User Configuration:

mkdir -p ~/.config/prtip
nano ~/.config/prtip/config.toml

Configuration Structure

Complete Example:

[scan]
default_scan_type = "syn"  # Default to TCP SYN scan (-sS)
default_ports = "1-1000"   # Scan top 1000 ports by default
timeout = 5000             # Connection timeout in milliseconds
max_retries = 3            # Maximum retry attempts per port

[timing]
template = "normal"        # Timing template (T3)
min_rate = 10             # Minimum packet rate (packets/sec)
max_rate = 1000           # Maximum packet rate (packets/sec)

[output]
default_format = "text"   # Default output format
colorize = true           # Enable colorized output
verbose = false           # Disable verbose mode by default

[performance]
numa = false              # NUMA optimization (Linux only)
batch_size = 1000         # Batch size for parallelism

[plugins]
enabled = true            # Enable plugin system
plugin_dir = "~/.prtip/plugins"  # Plugin directory location

Configuration Sections

Scan Settings

Controls default scanning behavior:

[scan]
default_scan_type = "syn"      # syn|connect|udp|fin|null|xmas|ack|idle
default_ports = "1-1000"       # Port specification
timeout = 5000                 # Milliseconds
max_retries = 3                # Retry count
skip_host_discovery = false    # Skip ping (-Pn)

Timing Configuration

Controls scan speed and timing:

[timing]
template = "normal"            # paranoid|sneaky|polite|normal|aggressive|insane (T0-T5)
min_rate = 10                  # Minimum packets per second
max_rate = 1000                # Maximum packets per second
host_delay = 0                 # Milliseconds between probes

Output Settings

Controls output formatting and verbosity:

[output]
default_format = "text"        # text|json|xml|greppable
colorize = true                # Enable ANSI colors
verbose = false                # Verbose output (-v)
append_timestamp = true        # Append timestamp to filenames

Performance Tuning

Advanced performance options:

[performance]
numa = false                   # Enable NUMA optimization (Linux)
batch_size = 1000             # Parallelism batch size
max_concurrent = 10000        # Maximum concurrent connections

Plugin System

Plugin configuration:

[plugins]
enabled = true                 # Enable/disable plugins
plugin_dir = "~/.prtip/plugins"  # Plugin directory
auto_load = ["banner-grab", "http-headers"]  # Auto-load plugins

Environment Variables

Environment variables provide runtime configuration without modifying files.

Usage Examples:

# Use custom configuration file
export PRTIP_CONFIG=~/my-config.toml
prtip -sS -p 80,443 192.168.1.1

# Enable debug logging
export PRTIP_LOG=debug
sudo -E prtip -sS -p 80,443 192.168.1.1

# Override thread count
export PRTIP_THREADS=4
prtip -sS -p 1-1000 192.168.1.0/24

# Disable command history (testing/automation)
export PRTIP_DISABLE_HISTORY=true
prtip -sS -F target.com

Scan Templates

Scan templates provide pre-configured scanning scenarios with a single command.

Built-in Templates

ProRT-IP includes 10 built-in templates:

Web Server Scanning:

prtip --template web-servers 192.168.1.0/24
# Equivalent to: -p 80,443,8080,8443 -sV --script http-*

Database Discovery:

prtip --template databases 192.168.1.1
# Equivalent to: -p 3306,5432,27017,6379,1521 -sV

Quick Scan (Top 100 Ports):

prtip --template quick 192.168.1.0/24
# Equivalent to: -F -T4 -sS

Comprehensive Scan:

prtip --template thorough 192.168.1.1
# Equivalent to: -p- -T3 -sV -O

Stealth Scan (Evasion):

prtip --template stealth 192.168.1.1
# Equivalent to: -sF -T0 -f -D RND:5

SSL/TLS Analysis:

prtip --template ssl-only 192.168.1.1
# Equivalent to: -p 443,8443,993,995,465,636,3389 -sV --tls-analysis

Additional Templates:

• discovery - Network discovery and host enumeration
• admin-panels - Common admin interface ports
• mail-servers - Email service discovery
• file-shares - SMB/NFS/FTP scanning

Template Management

List Available Templates:

prtip --list-templates

Show Template Details:

prtip --show-template web-servers

Override Template Values:

# Override port range
prtip --template quick -p 1-10000

# Override timing
prtip --template stealth -T3

# Add additional flags
prtip --template web-servers -sV --version-intensity 9

Custom Templates

Create custom templates in ~/.prtip/templates.toml:

[templates.staging-web]
description = "Scan staging environment web servers"
ports = "80,443,3000,8080,8443"
scan_type = "syn"
timing = "T4"
service_detection = true

[templates.internal-audit]
description = "Internal network security audit"
ports = "1-65535"
scan_type = "syn"
timing = "T3"
service_detection = true
os_detection = true
evasion = ["fragment", "ttl=64"]

[templates.dns-servers]
description = "DNS server discovery and testing"
ports = "53,853,5353"
scan_type = "udp"
service_detection = true

Using Custom Templates:

prtip --template staging-web 10.0.0.0/24
prtip --template internal-audit 192.168.1.0/24

Configuration Precedence

Configuration sources are applied in the following order (highest to lowest priority):

1. Command-line flags (highest priority)
2. Environment variables
3. Project configuration (./prtip.toml)
4. User configuration (~/.config/prtip/config.toml)
5. System configuration (/etc/prtip/config.toml)
6. Built-in defaults (lowest priority)

Example Precedence:

# System config (/etc/prtip/config.toml)
[scan]
default_ports = "1-1000"

# User config (~/.config/prtip/config.toml)
[scan]
default_ports = "1-10000"

# Command-line
prtip -p 80,443 target.com
# Result: Scans ports 80 and 443 (command-line wins)

Platform-Specific Configuration

Linux Configuration

NUMA Optimization:

[performance]
numa = true                    # Enable NUMA optimization
numa_nodes = [0, 1]           # Specific NUMA nodes

Capabilities (No sudo):

# Set capabilities (one-time setup)
sudo setcap cap_net_raw,cap_net_admin=eip /usr/local/bin/prtip

# Configure for non-root use
[scan]
drop_privileges = true
user = "scanner"
group = "scanner"

Windows Configuration

Npcap Settings:

[windows]
npcap_path = "C:\\Program Files\\Npcap"
loopback_support = true

macOS Configuration

BPF Device Access:

[macos]
bpf_buffer_size = 4194304     # 4MB buffer
bpf_devices = ["/dev/bpf0", "/dev/bpf1"]

Configuration Validation

Validate Configuration:

prtip --validate-config
prtip --validate-config --config ~/custom.toml

Example Output:

✓ Configuration valid
✓ All plugins loadable
✓ Database path writable
⚠ Warning: NUMA enabled but system has only 1 NUMA node
✓ Timing values within acceptable ranges

See Also

• Basic Usage - Getting started with ProRT-IP
• CLI Reference - Complete command-line reference
• Scan Templates - Template system documentation
• Performance Tuning - Optimization guide
• Environment Variables - Complete variable reference

Scan Templates

Scan templates provide pre-configured scanning scenarios for common use cases. Templates combine port specifications, scan types, timing settings, and detection options into reusable configurations accessible via the --template flag.

Quick Start

# List all available templates
prtip --list-templates

# Use a built-in template
prtip --template web-servers 192.168.1.0/24

# Show template details before using
prtip --show-template stealth

# Override template settings with CLI flags
prtip --template stealth -T4 192.168.1.1  # Use stealth template but with T4 timing

Built-in Templates

ProRT-IP includes 10 built-in templates optimized for common scanning scenarios:

web-servers

Scan common web server ports with service and TLS certificate detection.

Use Case: Discovering web applications, identifying web frameworks, analyzing SSL/TLS configurations.

# Basic web server scan
prtip --template web-servers 10.0.0.0/24

# Web scan with verbose output
prtip --template web-servers -v 192.168.1.0/24

# Web scan with JSON output
prtip --template web-servers -oJ results.json target.com

databases

Scan common database ports including MySQL, PostgreSQL, MongoDB, Redis, MSSQL, CouchDB, and Cassandra.

Use Case: Database discovery, identifying exposed database services, inventory auditing.

# Database discovery scan
prtip --template databases 192.168.1.0/24

# Database scan with service version detection
prtip --template databases -sV db-servers.txt

Port Reference:

quick

Fast scan of top 100 most common ports without service detection.

Use Case: Rapid network reconnaissance, initial host enumeration, large network sweeps.

# Quick scan of a network
prtip --template quick 10.0.0.0/8

# Quick scan with output to file
prtip --template quick -oN quick-results.txt 192.168.0.0/16

thorough

Comprehensive scan of all 65,535 ports with service and OS detection.

Use Case: Complete host analysis, penetration testing, comprehensive security assessments.

# Thorough scan of a single host
prtip --template thorough target.com

# Thorough scan with all output formats
prtip --template thorough -oA full-scan target.com

Warning: Thorough scans take significantly longer. For a single host, expect 10-30 minutes depending on network conditions.

stealth

Evasive scanning to minimize detection using FIN scan, slow timing, randomization, and packet fragmentation.

Use Case: Penetration testing, IDS/IPS evasion testing, stealth reconnaissance.

# Stealth scan
prtip --template stealth -p 22,80,443 target.com

# Stealth scan with decoys
prtip --template stealth -D RND:5 target.com

Note: FIN scans may not work against all systems. Windows hosts and some firewalls don't respond to FIN packets as expected per RFC 793.

discovery

Host discovery only using ICMP ping without port scanning.

Use Case: Network mapping, identifying live hosts, pre-scan reconnaissance.

# Discover live hosts
prtip --template discovery 192.168.1.0/24

# Discovery with specific output
prtip --template discovery -oG live-hosts.gnmap 10.0.0.0/8

ssl-only

Scan HTTPS and other TLS-enabled ports with certificate analysis.

Use Case: SSL/TLS security assessments, certificate inventory, encryption compliance audits.

# SSL certificate scan
prtip --template ssl-only target.com

# SSL scan with verbose certificate details
prtip --template ssl-only -v --tls-details target.com

Port Reference:

admin-panels

Scan remote administration ports including SSH, Telnet, RDP, VNC, and management interfaces.

Use Case: Administrative access discovery, remote management auditing, attack surface assessment.

# Admin panel discovery
prtip --template admin-panels 192.168.1.0/24

# Admin scan with service version detection
prtip --template admin-panels -sV internal-servers.txt

Port Reference:

mail-servers

Scan email server ports including SMTP, IMAP, POP3, and their secure variants.

Use Case: Email infrastructure discovery, mail server inventory, email security assessments.

# Mail server discovery
prtip --template mail-servers mx-records.txt

# Mail scan with verbose output
prtip --template mail-servers -v mail.example.com

Port Reference:

file-shares

Scan file sharing protocols including FTP, SFTP, SMB, NFS, and rsync.

Use Case: File share discovery, network storage auditing, data exfiltration risk assessment.

# File share discovery
prtip --template file-shares 192.168.1.0/24

# File share scan with greppable output
prtip --template file-shares -oG shares.gnmap internal-network.txt

Port Reference:

Custom Templates

Create custom templates in ~/.prtip/templates.toml to define reusable scanning configurations tailored to your environment.

Template Configuration Format

[my-template-name]
description = "Human-readable description of the template"
ports = [80, 443, 8080]           # Optional: specific ports to scan
scan_type = "SYN"                 # Optional: SYN, Connect, UDP, FIN, NULL, Xmas, ACK, Idle
service_detection = true          # Optional: enable service detection
os_detection = false              # Optional: enable OS fingerprinting
timing = "T3"                     # Optional: T0-T5 timing template
max_rate = 1000                   # Optional: maximum packets per second
randomize = false                 # Optional: randomize port/target order
fragment = false                  # Optional: enable packet fragmentation
tls_analysis = false              # Optional: enable TLS certificate analysis
discovery_only = false            # Optional: host discovery only (no port scan)

Example Custom Templates

# ~/.prtip/templates.toml

# Internal network scan with company-specific ports
[internal-services]
description = "Scan internal company services"
ports = [80, 443, 8080, 8443, 9200, 9300, 5601, 3000, 8081, 8082]
scan_type = "Connect"
service_detection = true
timing = "T4"

# IoT device discovery
[iot-devices]
description = "Scan common IoT and embedded device ports"
ports = [80, 443, 23, 8080, 8443, 554, 1883, 8883, 5683]
scan_type = "SYN"
service_detection = true
timing = "T3"
tls_analysis = true

# High-speed reconnaissance
[speed-scan]
description = "Maximum speed network sweep"
scan_type = "SYN"
service_detection = false
timing = "T5"
max_rate = 100000

# Ultra-stealth assessment
[ultra-stealth]
description = "Minimal footprint stealth scan"
scan_type = "FIN"
timing = "T0"
max_rate = 10
randomize = true
fragment = true

Using Custom Templates

# Use custom template
prtip --template internal-services 10.0.0.0/8

# List all templates (built-in + custom)
prtip --list-templates

# Show custom template details
prtip --show-template internal-services

Template Inheritance

Custom templates with the same name as built-in templates override the built-in version:

# Override the built-in web-servers template
[web-servers]
description = "Custom web servers scan with additional ports"
ports = [80, 443, 8080, 8443, 3000, 5000, 8000, 8888, 9000, 9443]
scan_type = "SYN"
service_detection = true
tls_analysis = true
timing = "T4"  # Faster than default T3

Template Validation

Templates are validated when loaded. Invalid configurations will produce clear error messages:

$ prtip --template invalid-template
Error: Invalid custom template 'invalid-template' in ~/.prtip/templates.toml
  Caused by: Invalid scan_type 'INVALID': must be one of SYN, Connect, UDP, FIN, NULL, Xmas, ACK, Idle

Validation Rules

Testing Templates

Validate your custom templates before using them:

# Show template details (validates the template)
prtip --show-template my-custom-template

# Dry run with verbose output
prtip --template my-custom-template -v --dry-run 192.168.1.1

Template Override Behavior

CLI flags override template settings. This allows fine-tuning template behavior:

# Use stealth template but with T3 timing instead of T1
prtip --template stealth -T3 target.com

# Use web-servers template but add additional ports
prtip --template web-servers -p 80,443,8080,9000,9443 target.com

# Use thorough template but with faster timing
prtip --template thorough -T4 --max-rate 10000 target.com

Override Priority: CLI flags > Custom templates > Built-in templates > Defaults

Performance Characteristics

Note: Times are approximate and depend on network conditions, target responsiveness, and system resources.

CI/CD Integration

Templates integrate well with automated security pipelines:

# GitHub Actions example
- name: Scan web servers
  run: |
    prtip --template web-servers -oJ results.json ${{ env.TARGET }}

- name: Check for critical findings
  run: |
    jq '.ports[] | select(.state == "open")' results.json

# Jenkins/Shell script example
#!/bin/bash
TARGETS="192.168.1.0/24"
prtip --template databases -oG databases.gnmap $TARGETS
prtip --template admin-panels -oG admin.gnmap $TARGETS
prtip --template file-shares -oG shares.gnmap $TARGETS

# Parse results
grep "open" *.gnmap > all-open-ports.txt

See Also

• Configuration Guide - Global configuration options
• CLI Reference - Complete command-line reference
• Basic Usage - Getting started with scanning
• Timing Templates - T0-T5 timing details
• Evasion Techniques - Stealth scanning methods

Last Updated: 2025-11-21 ProRT-IP Version: v0.5.4

IPv6 Support

Complete IPv6 support across all scan types with dual-stack scanning capabilities.

What is IPv6?

IPv6 (Internet Protocol version 6) is the next-generation internet protocol designed to replace IPv4. With 340 undecillion addresses (2^128), IPv6 solves IPv4 address exhaustion while providing enhanced features for modern networks.

ProRT-IP IPv6 Capabilities:

• 100% Scanner Coverage: All 8 scan types support both IPv4 and IPv6
• Dual-Stack Resolution: Automatic hostname resolution to both protocols
• Protocol Preference: User-controlled IPv4/IPv6 preference with fallback
• CIDR Support: Full IPv6 CIDR notation (/64, /48, etc.) for subnet scanning
• ICMPv6 & NDP: Native support for IPv6 discovery protocols
• Performance Parity: IPv6 scans match or exceed IPv4 performance

Version History:

• Sprint 4.21: TCP Connect IPv6 foundation ✅
• Sprint 5.1 Phase 1: TCP Connect + SYN IPv6 ✅
• Sprint 5.1 Phase 2: UDP + Stealth IPv6 ✅
• Sprint 5.1 Phase 3: Discovery + Decoy IPv6 ✅
• Sprint 5.1 Phase 4: CLI flags, documentation ✅

IPv6 Addressing

Address Types

1. Global Unicast (2000::/3)

Internet-routable addresses (equivalent to public IPv4)

Format: 2001:db8:85a3::8a2e:370:7334

Usage:

# Scan a single global address
prtip -sS -p 80,443 2001:4860:4860::8888

# Scan a /64 subnet (256 addresses)
prtip -sS -p 80,443 2001:db8::0/120

Characteristics:

• Routable on public internet
• First 48 bits: Global routing prefix
• Next 16 bits: Subnet ID
• Last 64 bits: Interface Identifier (IID)

2. Link-Local (fe80::/10)

Single network segment communication (equivalent to APIPA in IPv4)

Format: fe80::1234:5678:90ab:cdef

Usage:

# Requires interface specification (zone ID)
prtip -sS -p 80,443 fe80::1%eth0        # Linux
prtip -sS -p 80,443 fe80::1%en0         # macOS
prtip -sS -p 80,443 fe80::1%12          # Windows (interface index)

Characteristics:

• Not routable beyond local link
• Auto-configured on all IPv6 interfaces
• Always start with fe80::
• Common for device-to-device communication

3. Unique Local (fc00::/7)

Private IPv6 networks (equivalent to RFC 1918 in IPv4)

Format: fd00:1234:5678:90ab::1

Usage:

# Scan ULA address
prtip -sS -p 22,80,443 fd12:3456:789a:1::1

# Scan /48 organization network
prtip -sS -p 22,80,443 fd00:1234:5678::/48

Characteristics:

• Not routable on public internet
• Unique within organization
• fc00::/7 range (fd00::/8 for locally assigned)

4. Multicast (ff00::/8)

One-to-many communication

Common Addresses:

• ff02::1 - All nodes on local link
• ff02::2 - All routers on local link
• ff02::1:ffXX:XXXX - Solicited-node multicast (NDP)

Usage:

# Scan all nodes on local link (may be blocked)
prtip -sS -p 80,443 ff02::1

5. Loopback (::1/128)

Local host testing (equivalent to 127.0.0.1 in IPv4)

Format: ::1

Usage:

# Test local services
prtip -sS -p 80,443 ::1

# Service detection on loopback
prtip -sT -sV -p 22,80,443,3306,5432 ::1

Characteristics:

• Single address (not a subnet)
• Always refers to local system
• Ideal for scanner validation tests

Address Notation

Full Format

2001:0db8:85a3:0000:0000:8a2e:0370:7334

Compressed Format (Recommended)

2001:db8:85a3::8a2e:370:7334

Compression Rules:

• Leading zeros can be omitted: 0db8 → db8
• Consecutive zero blocks become :: (only once): 0000:0000 → ::
• Use lowercase hexadecimal (convention)

CIDR Notation

# Common prefix lengths
2001:db8::1/128          # Single host
2001:db8::/64            # Single subnet (18.4 quintillion addresses)
2001:db8::/48            # Medium organization (65,536 subnets)
2001:db8::/32            # Large organization or ISP

Scanning Guidelines:

• /128: Single host
• /120: 256 hosts (manageable)
• /112: 65,536 hosts (slow but feasible)
• /64: 18.4 quintillion hosts (NEVER scan fully)

CLI Flags

Primary Flags

-6 / --ipv6 - Force IPv6

Prefer IPv6 addresses when resolving hostnames

# Force IPv6 resolution
prtip -sS -6 -p 80,443 example.com

# Mixed targets (hostname→IPv6, literals unchanged)
prtip -sS -6 -p 80,443 example.com 192.168.1.1 2001:db8::1

Behavior:

• Hostnames resolve to AAAA records (IPv6)
• IPv4/IPv6 literals remain unchanged
• Falls back to IPv4 if no AAAA record

Nmap Compatible: ✅ Equivalent to nmap -6

-4 / --ipv4 - Force IPv4

Prefer IPv4 addresses when resolving hostnames

# Force IPv4 resolution
prtip -sS -4 -p 80,443 example.com

Behavior:

• Hostnames resolve to A records (IPv4)
• IPv4/IPv6 literals remain unchanged
• Falls back to IPv6 if no A record

Nmap Compatible: ✅ Equivalent to nmap -4

Advanced Flags

--prefer-ipv6 - Prefer with Fallback

Use IPv6 when available, fall back to IPv4

# Prefer IPv6, graceful degradation
prtip -sS --prefer-ipv6 -p 80,443 dual-stack.example.com

Use Case: Testing IPv6 connectivity before IPv6-only deployment

--prefer-ipv4 - Prefer with Fallback

Use IPv4 when available, fall back to IPv6

# Prefer IPv4 (default behavior)
prtip -sS --prefer-ipv4 -p 80,443 example.com

Use Case: Legacy networks, gradual IPv6 migration

--ipv6-only - Strict IPv6 Mode

Reject all IPv4 addresses, IPv6 only

# IPv6-only scan (error on IPv4 targets)
prtip -sS --ipv6-only -p 80,443 2001:db8::/64

# Error: IPv4 address in IPv6-only mode
prtip -sS --ipv6-only -p 80,443 192.168.1.1
# Error: Target 192.168.1.1 is IPv4, but --ipv6-only specified

Use Case: IPv6-only networks, security assessments requiring IPv6 purity

--ipv4-only - Strict IPv4 Mode

Reject all IPv6 addresses, IPv4 only

# IPv4-only scan (error on IPv6 targets)
prtip -sS --ipv4-only -p 80,443 192.168.1.0/24

Use Case: Legacy networks, IPv4-only security assessments

Flag Conflicts

Invalid Combinations:

# Error: Cannot specify both -6 and -4
prtip -sS -6 -4 -p 80,443 example.com

# Error: Conflicting preferences
prtip -sS --ipv6-only --prefer-ipv4 -p 80,443 example.com

Valid Combinations:

# OK: Preference flags are compatible
prtip -sS -6 --prefer-ipv6 -p 80,443 example.com

Scanner-Specific Behavior

1. TCP Connect (-sT)

IPv6 Support: ✅ Full dual-stack (Sprint 5.1 Phase 1)

Description: Full TCP three-way handshake using OS TCP stack

# IPv6 single host
prtip -sT -p 80,443 2001:db8::1

# IPv6 CIDR
prtip -sT -p 22,80,443 2001:db8::/120

# Dual-stack target list
prtip -sT -p 80,443 192.168.1.1 2001:db8::1 example.com

Behavior:

• Uses kernel TCP stack (no raw sockets)
• No root privileges required
• Automatic IPv4/IPv6 socket creation
• Full connection establishment

Performance:

• IPv6 overhead: <5% vs IPv4
• Loopback: ~5ms for 6 ports
• LAN: ~20-50ms depending on RTT

Port States:

• Open: SYN → SYN+ACK → ACK completed
• Closed: SYN → RST received
• Filtered: SYN timed out

2. SYN Scanner (-sS)

IPv6 Support: ✅ Full dual-stack (Sprint 5.1 Phase 1)

Description: Half-open scanning (SYN without completing handshake)

Requires: Root/administrator (raw socket access)

# IPv6 SYN scan
sudo prtip -sS -p 80,443 2001:db8::1

# IPv6 subnet
sudo prtip -sS -p 1-1000 2001:db8::/120

# Dual-stack with IPv6 preference
sudo prtip -sS -6 -p 80,443 example.com

Behavior:

• Sends SYN, waits for SYN+ACK or RST
• Sends RST to abort (no full handshake)
• Stealthier than Connect scan
• Automatic IPv6 pseudo-header checksum

Performance:

• IPv6 overhead: <10% vs IPv4
• Loopback: ~10ms for 6 ports
• LAN: ~15-40ms

IPv6 Considerations:

• IPv6 header: 40 bytes (vs 20 bytes IPv4)
• TCP checksum includes IPv6 addresses
• No fragmentation by default

3. UDP Scanner (-sU)

IPv6 Support: ✅ Full dual-stack (Sprint 5.1 Phase 2)

Description: UDP datagrams with protocol-specific payloads

Requires: Root/administrator (raw ICMP socket)

# IPv6 UDP scan (common services)
sudo prtip -sU -p 53,123,161 2001:db8::1

# IPv6 subnet DNS scan
sudo prtip -sU -p 53 2001:db8::/120

Behavior:

• Sends UDP datagrams to target ports
• Waits for UDP response or ICMPv6 Port Unreachable
• Protocol-specific payloads (DNS, SNMP, NTP, mDNS, DHCPv6)
• Interprets ICMPv6 Type 1 Code 4 as "closed"

Performance:

• Slower than TCP: 10-100x due to stateless nature
• IPv6 overhead: <5% vs IPv4
• Timeout-dependent (use T4 or T5)

Protocol Payloads (IPv6-compatible):

• DNS (53): version.bind TXT query
• SNMP (161): GetRequest for sysDescr.0
• NTP (123): Mode 3 client request
• mDNS (5353): _services._dns-sd._udp.local PTR
• DHCPv6 (547): SOLICIT message

Port States:

• Open: UDP response received
• Closed: ICMPv6 Port Unreachable
• Open|Filtered: No response (timeout)
• Filtered: ICMPv6 Administratively Prohibited

4. Stealth Scanners (-sF, -sN, -sX, -sA)

IPv6 Support: ✅ Full dual-stack (Sprint 5.1 Phase 2)

Description: Unusual TCP flag combinations to evade firewalls

Requires: Root/administrator (raw sockets)

FIN Scan (-sF)

sudo prtip -sF -p 80,443 2001:db8::1

• Sends FIN flag only
• Open: No response | Closed: RST

NULL Scan (-sN)

sudo prtip -sN -p 80,443 2001:db8::1

• No flags set
• Open: No response | Closed: RST

Xmas Scan (-sX)

sudo prtip -sX -p 80,443 2001:db8::1

• FIN+PSH+URG flags ("lit up like Christmas")
• Open: No response | Closed: RST

ACK Scan (-sA)

sudo prtip -sA -p 80,443 2001:db8::1

• ACK flag only (firewall detection)
• Unfiltered: RST | Filtered: No response

Port States:

• Open|Filtered: No response (timeout)
• Closed: RST received
• Filtered: ICMP unreachable

IPv6 Considerations:

• IPv6 firewalls may behave differently
• Stateful firewalls often block these scans
• Windows doesn't follow RFC 793 for closed ports

5. Discovery Engine (--discovery)

IPv6 Support: ✅ Full ICMPv6 & NDP (Sprint 5.1 Phase 3)

Description: Host discovery using ICMP Echo and NDP

Requires: Root/administrator (raw ICMP socket)

# IPv6 host discovery
sudo prtip --discovery 2001:db8::/120

# Dual-stack discovery
sudo prtip --discovery 192.168.1.0/24 2001:db8::/120

# Discovery then scan
sudo prtip --discovery --discovery-then-scan -p 80,443 2001:db8::/120

Protocols:

ICMPv6 Echo Request/Reply

• Type 128: Echo Request (IPv6 ICMP Type 8 equivalent)
• Type 129: Echo Reply (IPv6 ICMP Type 0 equivalent)
• Basic host liveness check

NDP Neighbor Discovery (RFC 4861)

• Type 135: Neighbor Solicitation (NS)
• Type 136: Neighbor Advertisement (NA)
• Link-layer address resolution + host discovery
• More reliable than Echo on local links

Solicited-Node Multicast:

Target Address: 2001:db8::1234:5678
Solicited-Node: ff02::1:ff34:5678
                          ^^^^^^^^
                          Last 24 bits

Performance:

• ICMPv6 Echo: ~20-50ms per host
• NDP: ~10-30ms on local link (faster)
• Combined: ~50-100ms per host
• Scales linearly with CPU cores

6. Decoy Scanner (-D)

IPv6 Support: ✅ Full dual-stack with /64-aware generation (Sprint 5.1 Phase 3)

Description: Obscure source by generating traffic from multiple IPs

Requires: Root/administrator (source spoofing)

# IPv6 decoy scan (5 random decoys)
sudo prtip -sS -D RND:5 -p 80,443 2001:db8::1

# Manual decoy list
sudo prtip -sS -D 2001:db8::10,2001:db8::20,ME,2001:db8::30 \
    -p 80,443 2001:db8::1

# Subnet scan with decoys
sudo prtip -sS -D RND:10 -p 80,443 2001:db8::/120

Behavior:

• Sends packets from real IP + decoy IPs
• Decoy IPs are spoofed (source manipulation)
• Target sees traffic from N+1 sources
• ME keyword specifies real IP position

IPv6 Decoy Generation:

• Random /64 Interface Identifiers
• Subnet-aware (uses target's network prefix)
• Avoids 7 reserved ranges:
  1. Loopback (::1/128)
  2. Multicast (ff00::/8)
  3. Link-local (fe80::/10)
  4. ULA (fc00::/7)
  5. Documentation (2001:db8::/32)
  6. IPv4-mapped (::ffff:0:0/96)
  7. Unspecified (::/128)

IPv6 /64 Rationale:

• Most IPv6 subnets are /64
• Decoys within same /64 more believable
• SLAAC uses /64 boundaries
• NDP operates within /64 scope

Performance:

• 2-5% overhead per decoy
• 5 decoys: ~10-25% total overhead
• 10 decoys: ~20-50% total overhead

Limitations:

• Egress filtering may block spoofed packets
• Return packets only reach real IP
• Modern IDS can correlate timing patterns

Protocol Details

ICMPv6 Message Types

Type 1: Destination Unreachable

Codes:

• 0: No route to destination
• 1: Communication administratively prohibited (filtered)
• 3: Address unreachable (host down)
• 4: Port unreachable (closed port)

ProRT-IP Interpretation:

#![allow(unused)]
fn main() {
// Code 4 = closed port
if icmpv6_type == 1 && icmpv6_code == 4 {
    port_state = PortState::Closed;
}

// Code 1 = firewall filtering
if icmpv6_type == 1 && icmpv6_code == 1 {
    port_state = PortState::Filtered;
}
}

Type 135/136: NDP

Solicited-Node Multicast Example:

Target: 2001:db8::1234:5678:9abc:def0
Multicast: ff02::1:ff9a:bcdef0

ProRT-IP NDP Flow:

1. Build NS packet with target IPv6
2. Calculate solicited-node multicast (ff02::1:ffXX:XXXX)
3. Send to multicast (all nodes on link process)
4. Wait for NA with target's link-layer address
5. Mark host alive if NA received

Performance:

• NDP faster than Echo on local links (~10-30ms vs 20-50ms)
• Bypasses ICMP filtering (NDP required for IPv6)
• Only works within L2 segment

TCP Over IPv6

IPv6 Pseudo-Header for Checksum

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                         Source Address                        |
|                            (128 bits)                         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                      Destination Address                      |
|                            (128 bits)                         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   TCP Length                  |     Zeros     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Key Differences from IPv4:

• IPv6 addresses: 128 bits (16 bytes) each
• No IP header checksum (delegated to link layer)
• TCP checksum includes full IPv6 addresses
• Pseudo-header is 40 bytes (vs 12 bytes IPv4)

UDP Over IPv6

Checksum:

• Same pseudo-header format as TCP
• UDP checksum mandatory in IPv6 (optional in IPv4)
• Zero checksum is invalid in IPv6

Performance Characteristics

IPv4 vs IPv6 Comparison

Conclusion: IPv6 overhead negligible on modern hardware (<5-10% in most scenarios)

Timeout Recommendations

Timing Template Adjustments:

# T3 (Normal) - Increased timeouts for IPv6
prtip -sS -T3 -p 80,443 2001:db8::1  # 2.5s timeout

# T4 (Aggressive) - Default IPv4 timeouts OK
prtip -sS -T4 -p 80,443 2001:db8::1  # 1.5s timeout

# T5 (Insane) - Minimal timeout, may miss responses
prtip -sS -T5 -p 80,443 2001:db8::1  # 500ms (risky)

Common Use Cases

1. Scanning IPv6 Loopback

Purpose: Local service enumeration, scanner testing

# TCP Connect (no privileges)
prtip -sT -p 22,80,443,3306,5432 ::1

# SYN scan (requires root)
sudo prtip -sS -p 1-1000 ::1

# Service detection
prtip -sT -sV -p 80,443 ::1

Expected Output:

Scanning ::1 (IPv6 loopback)...
PORT     STATE  SERVICE  VERSION
22/tcp   open   ssh      OpenSSH 8.9p1
80/tcp   open   http     nginx 1.18.0
443/tcp  open   https    nginx 1.18.0 (TLS 1.3)
3306/tcp open   mysql    MySQL 8.0.30

2. Scanning Link-Local Addresses

Purpose: Local network device discovery

# Link-local with interface (macOS/Linux)
prtip -sS -p 80,443 fe80::1%eth0

# Link-local subnet
prtip -sS -p 80,443 fe80::/64%eth0

# Discovery on link-local
sudo prtip --discovery fe80::/64%eth0

Platform-Specific Zone IDs:

• Linux: %eth0, %ens33, %wlan0
• macOS: %en0, %en1
• Windows: %12, %3 (interface index)
• FreeBSD: %em0, %re0

3. Scanning Global Unicast

Purpose: Internet-facing service enumeration

# Single global address
prtip -sS -p 80,443 2001:4860:4860::8888

# Multiple hosts
prtip -sS -p 80,443 2001:db8::1 2606:2800:220:1:248:1893:25c8:1946

# With service detection
prtip -sS -sV -p 80,443 2001:4860:4860::8888

4. IPv6 CIDR Scanning

Purpose: Subnet enumeration (targeted, not full /64)

# /120 subnet (256 addresses - manageable)
prtip -sS -p 80,443 2001:db8::0/120

# Discovery then port scan (efficient)
sudo prtip --discovery --discovery-then-scan -p 80,443 2001:db8::0/120

CIDR Guidelines:

• /120: 256 hosts (manageable)
• /112: 65,536 hosts (slow but feasible)
• /64: 18.4 quintillion (NEVER scan fully)

5. Dual-Stack Hosts

Purpose: Test both IPv4 and IPv6 connectivity

# Prefer IPv6, fallback to IPv4
prtip -sS --prefer-ipv6 -p 80,443 example.com

# Prefer IPv4, fallback to IPv6
prtip -sS --prefer-ipv4 -p 80,443 example.com

# Scan both explicitly
prtip -sS -p 80,443 example.com 2606:2800:220:1:248:1893:25c8:1946

6. Mixed IPv4/IPv6 Targets

Purpose: Heterogeneous network scanning

# Mixed targets (auto-detect protocol)
prtip -sS -p 80,443 \
    192.168.1.1 \
    2001:db8::1 \
    example.com \
    10.0.0.0/24 \
    2001:db8::/120

# With protocol preference
prtip -sS -6 -p 80,443 \
    192.168.1.1 \      # IPv4 literal (unchanged)
    example.com \       # Resolves to IPv6
    2001:db8::1         # IPv6 literal (unchanged)

7. IPv6 Service Detection

Purpose: Identify services and versions

# Service detection
prtip -sT -sV -p 22,80,443 2001:db8::1

# Aggressive scan (OS + Service + Scripts)
prtip -sS -A -p- 2001:db8::1

# High intensity
prtip -sT -sV --version-intensity 9 -p 80,443 2001:db8::1

8. IPv6 Stealth Scanning

Purpose: Evade firewalls and IDS

# FIN scan with timing
sudo prtip -sF -T2 -p 80,443 2001:db8::1

# NULL scan with decoys
sudo prtip -sN -D RND:5 -p 80,443 2001:db8::1

9. IPv6 Decoy Scanning

Purpose: Obscure scan origin

# Random decoys
sudo prtip -sS -D RND:10 -p 80,443 2001:db8::1

# Manual decoys with ME positioning
sudo prtip -sS -D 2001:db8::10,2001:db8::20,ME,2001:db8::30 \
    -p 80,443 2001:db8::1

10. Hostname Resolution

Purpose: Resolve dual-stack hostnames

# Default: Prefer IPv4
prtip -sS -p 80,443 example.com

# Force IPv6
prtip -sS -6 -p 80,443 example.com

# Show DNS details
prtip -sS -6 -vvv -p 80,443 example.com

Troubleshooting

Common Issues

Issue 1: "IPv6 not supported"

Error:

Error: IPv6 not supported on this interface

Causes:

• IPv6 disabled in OS
• No IPv6 address on interface
• Kernel module not loaded

Solutions:

# Check IPv6 status (Linux)
ip -6 addr show
sysctl net.ipv6.conf.all.disable_ipv6

# Enable IPv6 (Linux)
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=0

# Check IPv6 (macOS)
ifconfig | grep inet6

# Enable IPv6 (macOS)
sudo networksetup -setv6automatic Wi-Fi

# Check IPv6 (Windows)
netsh interface ipv6 show config

# Enable IPv6 (Windows)
netsh interface ipv6 install

Issue 2: NDP Timeouts

Error:

Warning: NDP timeout for fe80::1%eth0

Causes:

• Wrong interface
• Firewall blocking ICMPv6 Type 135/136
• Host not on local link

Solutions:

# List interfaces
ip link show  # Linux
ifconfig -a   # macOS

# Verify link-local addresses
ip -6 addr show eth0

# Test NDP manually
ping6 -c 1 -I eth0 ff02::1  # All nodes

Issue 3: ICMPv6 Unreachable Not Received

Symptom: All UDP ports show "open|filtered"

Causes:

• Firewall dropping ICMPv6
• Rate limiting on ICMPv6
• Packet loss

Solutions:

# Increase timeout
prtip -sU --timeout 5000 -p 53,123,161 2001:db8::1

# Aggressive timing
prtip -sU -T5 -p 53,123,161 2001:db8::1

# Test with known-closed port
prtip -sU -p 9999 2001:db8::1  # Should be "closed"

Issue 4: Link-Local Scope Issues

Error:

Error: Cannot connect to fe80::1: Invalid argument

Cause: Missing zone ID

Solution:

# WRONG: No zone ID
prtip -sS -p 80,443 fe80::1

# CORRECT: With zone ID
prtip -sS -p 80,443 fe80::1%eth0  # Linux
prtip -sS -p 80,443 fe80::1%en0   # macOS
prtip -sS -p 80,443 fe80::1%12    # Windows

Issue 5: Firewall Blocking ICMPv6 Echo

Symptom: No Echo response, but NDP works

Cause: Firewall allows NDP (required) but blocks Echo

Solutions:

# Use NDP-only discovery
sudo prtip --discovery --ndp-only 2001:db8::/120

# Check firewall (Linux)
sudo ip6tables -L -n | grep icmpv6

# Temporarily allow Echo (TESTING ONLY)
sudo ip6tables -I INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT

Platform-Specific

Linux

# Use sudo for raw sockets
sudo prtip -sS -p 80,443 2001:db8::1

# OR: Grant CAP_NET_RAW (persistent)
sudo setcap cap_net_raw=eip /path/to/prtip

macOS

# Use sudo (required)
sudo prtip -sS -p 80,443 2001:db8::1

# Verify BPF permissions
ls -l /dev/bpf*

Windows

# Install Npcap
# https://npcap.com/

# Verify installation
sc query npcap

# Run as Administrator

FreeBSD

# Use sudo
sudo prtip -sS -p 80,443 2001:db8::1

# Verify IPv6 enabled
sysctl net.inet6.ip6.forwarding

Best Practices

1. When to Use IPv6 vs IPv4

Use IPv6 When:

• Target is dual-stack or IPv6-only
• Testing IPv6-specific vulnerabilities
• Assessing IPv6 security posture
• Future-proofing assessments
• ISP/cloud is IPv6-native

Use IPv4 When:

• Legacy IPv4-only networks
• IPv6 firewall too restrictive
• Faster scan needed (slight edge)

Use Both When:

• Comprehensive security assessment
• Different firewall rules per protocol
• Comparing service availability

2. Protocol Preference Strategies

Default (Prefer IPv4)

# No flags = prefer IPv4
prtip -sS -p 80,443 example.com

Use Case: General scanning, legacy networks

Prefer IPv6

# Prefer IPv6, fallback IPv4
prtip -sS --prefer-ipv6 -p 80,443 example.com

Use Case: Modern networks, cloud, testing

Force IPv6 Only

# Strict IPv6 (error on IPv4)
prtip -sS --ipv6-only -p 80,443 2001:db8::/120

Use Case: IPv6-only networks, audits

Scan Both

# Explicit IPv4 + IPv6
prtip -sS -p 80,443 example.com \
    $(dig +short example.com A) \
    $(dig +short example.com AAAA)

Use Case: Compare protocol parity

3. Performance Optimization

Aggressive Timing

# T4/T5 for IPv6
prtip -sS -T4 -p 80,443 2001:db8::/120

Rationale: IPv6 slightly higher latency, aggressive timing compensates

Increase Parallelism

# High concurrency for /120
prtip -sS --max-concurrent 500 -p 80,443 2001:db8::/120

Rationale: IPv6 benefits from higher parallelism

Use NDP for Local Discovery

# 2-3x faster than Echo
sudo prtip --discovery --ndp-only fe80::/64%eth0

Rationale: NDP multicast more efficient than ICMP unicast

4. Security Considerations

IPv6-Specific Attack Surfaces

Router Advertisement Spoofing:

• Use RA Guard on switches
• Monitor for unexpected RAs

NDP Exhaustion:

• Implement NDP rate limiting
• Use ND Inspection

Extension Header Abuse:

• Drop excessive extension headers

Tunneling (6to4, Teredo):

• Scan for tunnel endpoints (UDP 3544)

Scanning Etiquette

Rate Limiting:

# Polite scan
prtip -sS -T2 --max-rate 100 -p 80,443 2001:db8::/120

Avoid Full /64:

# NEVER: Full /64
# prtip -sS -p 80,443 2001:db8::/64

# GOOD: Targeted /120
prtip -sS -p 80,443 2001:db8::/120

Respect Firewall Responses:

• ICMPv6 Administratively Prohibited = stop
• No response = timeout indicates firewall

Advanced Topics

1. IPv6 Fragmentation

Difference from IPv4:

• IPv6 routers do NOT fragment (only sender)
• Path MTU Discovery mandatory
• Minimum MTU: 1280 bytes (vs 68 IPv4)

Fragmentation Header:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Next Header  |   Reserved    |      Fragment Offset    |Res|M|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                         Identification                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Fields:

• Next Header: Protocol after reassembly
• Fragment Offset: 13 bits (8-byte units)
• M flag: More fragments (1=more, 0=last)
• Identification: 32 bits (unique per packet)

2. Extension Headers

Common Extension Headers:

1. Hop-by-Hop Options (0)
2. Routing (43)
3. Fragment (44)
4. Destination Options (60)
5. Authentication (AH) (51)
6. ESP (50)

Processing Order:

IPv6 Header
  → Hop-by-Hop
    → Routing
      → Fragment
        → Destination Options
          → TCP/UDP/ICMP

3. Privacy Addresses (RFC 4941)

Purpose: Prevent address-based tracking

Mechanism:

• Temporary addresses from random IIDs
• Change every 1-7 days
• Original address still used for servers

ProRT-IP Considerations:

# Stable address (consistent)
prtip -sS -p 80,443 2001:db8::1234:5678:90ab:cdef

# Privacy address (may change)
prtip -sS -p 80,443 2001:db8::a3f1:2b4c:9d8e:7f61

4. Solicited-Node Multicast

Purpose: Efficient neighbor resolution

Format:

Target:  2001:0db8::1234:5678:9abc:def0
Multicast: ff02::1:ff9a:bcdef0
           ^^^^^^^^^^^^^^
           ff02::1:ff + last 24 bits

Algorithm:

#![allow(unused)]
fn main() {
fn solicited_node_multicast(target: Ipv6Addr) -> Ipv6Addr {
    let octets = target.octets();
    let last_24 = [octets[13], octets[14], octets[15]];

    Ipv6Addr::new(
        0xff02, 0, 0, 0, 0, 1,
        0xff00 | (last_24[0] as u16),
        ((last_24[1] as u16) << 8) | (last_24[2] as u16),
    )
}
}

5. DHCPv6 vs SLAAC

SLAAC:

• No DHCP server
• Address = Prefix + EUI-64/random
• Fast, automatic, stateless

DHCPv6:

• Centralized management
• Stateful (tracks leases)
• Provides DNS, NTP, etc.

Scanning:

# SLAAC (predictable EUI-64)
prtip -sS -p 80,443 2001:db8::211:22ff:fe33:4455

# DHCPv6 (query server for list)
prtip -sS -p 80,443 $(cat dhcpv6-leases.txt)

See Also

• Stealth Scanning - Evasion techniques work with IPv6
• User Guide: Basic Usage - IPv6 target specification
• Architecture - IPv6 packet building design
• Nmap Compatibility - IPv6 flag compatibility

External Resources:

• Nmap IPv6 Documentation
• IANA IPv6 Address Space
• RFC 8200: IPv6 Specification
• RFC 4861: NDP Protocol

Last Updated: 2025-11-15 ProRT-IP Version: v0.5.2 Sprint: 5.1 (100% IPv6 Coverage)

Service Detection

Learn how ProRT-IP identifies services, versions, and operating systems through intelligent protocol analysis.

Overview

ProRT-IP's service detection combines two complementary approaches for industry-leading accuracy:

1. Regex-Based Detection (service_db.rs): Fast pattern matching using nmap-service-probes database (187 probes, 5,572 match patterns)
2. Protocol-Specific Detection: Deep protocol parsing for accurate version and OS information (Sprint 5.2)

Detection Coverage

Overall Detection Rate: 85-90% (improved from 70-80% baseline)

Key Features

• Protocol-Aware Parsing: Understands protocol structure beyond regex patterns
• OS Detection: Extracts OS hints from banners and version strings
• Version Mapping: Maps package versions to OS releases (e.g., "4ubuntu0.3" → Ubuntu 20.04)
• Priority System: Highest-priority detectors run first (HTTP=1, PostgreSQL=5)
• Fallback Chain: Protocol-specific → Regex → Generic detection
• Performance: <1% overhead compared to regex-only detection

Architecture

ProtocolDetector Trait

All protocol modules implement the ProtocolDetector trait for consistent detection:

#![allow(unused)]
fn main() {
pub trait ProtocolDetector {
    /// Detect service from response bytes
    fn detect(&self, response: &[u8]) -> Result<Option<ServiceInfo>, Error>;

    /// Base confidence level for this detector
    fn confidence(&self) -> f32;

    /// Priority (1=highest, 5=lowest)
    fn priority(&self) -> u8;
}
}

ServiceInfo Structure

Unified data structure for all detection results:

#![allow(unused)]
fn main() {
#[derive(Debug, Clone, PartialEq)]
pub struct ServiceInfo {
    pub service: String,           // Service name (e.g., "http", "ssh")
    pub product: Option<String>,   // Product name (e.g., "nginx", "OpenSSH")
    pub version: Option<String>,   // Version string (e.g., "1.21.6", "8.2p1")
    pub info: Option<String>,      // Additional info (protocol, OS hints)
    pub os_type: Option<String>,   // Detected OS (e.g., "Ubuntu 20.04 LTS")
    pub confidence: f32,           // Confidence score (0.0-1.0)
}
}

Detection Flow

Raw Response
    ↓
Protocol Detection (Priority Order)
    ↓
HTTP (Priority 1) → SSH (2) → SMB (3) → MySQL (4) → PostgreSQL (5)
    ↓
Match Found? → YES → Return ServiceInfo
    ↓ NO
Regex Detection (service_db.rs)
    ↓
Match Found? → YES → Return Basic ServiceInfo
    ↓ NO
Generic Detection (Port-based)

Protocol Modules

1. HTTP Fingerprinting

Priority: 1 (Highest) Confidence: 0.5-1.0 Coverage: 25-30% of services

Detection Method

Parses HTTP response headers to extract:

• Server: Web server name and version (e.g., "nginx/1.21.6")
• X-Powered-By: Technology stack (e.g., "PHP/7.4.3")
• X-AspNet-Version: ASP.NET version

Version Extraction

#![allow(unused)]
fn main() {
// Example: "nginx/1.21.6 (Ubuntu)" → product="nginx", version="1.21.6", os="Ubuntu"
if let Some(server) = headers.get("Server") {
    if let Some(slash_pos) = server.find('/') {
        product = server[..slash_pos];
        version = server[slash_pos+1..];
    }
}
}

OS Detection

• Apache: (Ubuntu), (Debian), (Red Hat) in Server header
• nginx: OS info after version string
• IIS: Infers Windows from Server: Microsoft-IIS/10.0

Confidence Calculation

Base: 0.5
+ 0.2 if Server header present
+ 0.15 if version extracted
+ 0.1 if OS detected
+ 0.05 if X-Powered-By present
Maximum: 1.0

Example Output

Service: http
Product: nginx
Version: 1.21.6
OS: Ubuntu
Info: Ubuntu + PHP/7.4.3
Confidence: 0.9

2. SSH Banner Parsing

Priority: 2 Confidence: 0.6-1.0 Coverage: 10-15% of services

Detection Method

Parses SSH protocol banners (RFC 4253 format):

SSH-protoversion-softwareversion [comments]

Examples:

• SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.3
• SSH-2.0-Dropbear_2020.81
• SSH-1.99-Cisco-1.25

Version Extraction

#![allow(unused)]
fn main() {
// Split by underscore or hyphen
"OpenSSH_8.2p1" → product="OpenSSH", version="8.2p1"
"Dropbear_2020.81" → product="Dropbear", version="2020.81"
"libssh-0.9.0" → product="libssh", version="0.9.0"
}

OS Detection

Ubuntu Mapping (digit before "ubuntu" keyword):

"4ubuntu0.3" → digit='4' → Ubuntu 20.04 LTS (Focal)
"5ubuntu0.1" → digit='5' → Ubuntu 22.04 LTS (Jammy)
"6ubuntu0.0" → digit='6' → Ubuntu 24.04 LTS (Noble)

Debian Mapping:

"deb9" → Debian 9 (Stretch)
"deb10" → Debian 10 (Buster)
"deb11" → Debian 11 (Bullseye)
"deb12" → Debian 12 (Bookworm)

Red Hat Mapping:

"el6" → Red Hat Enterprise Linux 6
"el7" → Red Hat Enterprise Linux 7
"el8" → Red Hat Enterprise Linux 8

Confidence Calculation

Base: 0.6
+ 0.1 if protocol version present
+ 0.2 if software version extracted
+ 0.1 if OS hint found
Maximum: 1.0

3. SMB Dialect Negotiation

Priority: 3 Confidence: 0.7-0.95 Coverage: 5-10% of services

Detection Method

Analyzes SMB protocol responses to determine dialect and infer Windows version.

SMB2/3 Magic Bytes: 0xFE 'S' 'M' 'B' (4 bytes) SMB1 Magic Bytes: 0xFF 'S' 'M' 'B' (4 bytes)

Dialect Extraction

Dialect code at offset 0x44 (72 bytes) in SMB2 Negotiate Response:

#![allow(unused)]
fn main() {
const DIALECT_OFFSET: usize = 0x44;
let dialect = u16::from_le_bytes([
    response[DIALECT_OFFSET],
    response[DIALECT_OFFSET + 1]
]);
}

Windows Version Mapping

Example Output

Service: microsoft-ds
Product: Samba/Windows SMB
Version: SMB 3.11
OS: Windows 10/2016+
Info: SMB 3.11 (Windows 10/2016+)
Confidence: 0.95

4. MySQL Handshake Parsing

Priority: 4 Confidence: 0.7-0.95 Coverage: 3-5% of services

Detection Method

Parses MySQL protocol handshake packets:

Structure:

Bytes 0-3: Packet length (3 bytes, little-endian) + sequence ID (1 byte)
Byte 4: Protocol version (always 10 for MySQL 5.x+)
Bytes 5+: Server version string (null-terminated)

Version Extraction

#![allow(unused)]
fn main() {
// Protocol version must be 10
if response[4] != 10 { return None; }

// Extract null-terminated version string
let version_str = extract_until_null(&response[5..]);
// Example: "8.0.27-0ubuntu0.20.04.1"
}

OS Detection

Ubuntu Version Extraction (handles "0.X.Y" pattern):

#![allow(unused)]
fn main() {
// "0ubuntu0.20.04.1" → skip leading "0." → "Ubuntu 20.04"
let parts = version_part.split('.').collect();
if parts.len() >= 3 && parts[0] == "0" {
    format!("Ubuntu {}.{}", parts[1], parts[2])
}
}

MySQL vs MariaDB:

Contains "MariaDB" → product="MariaDB"
Otherwise → product="MySQL"

Confidence Calculation

Base: 0.7
+ 0.15 if version extracted
+ 0.1 if OS/distribution hint found
Maximum: 1.0

5. PostgreSQL ParameterStatus Parsing

Priority: 5 (Lowest) Confidence: 0.7-0.95 Coverage: 3-5% of services

Detection Method

Parses PostgreSQL startup response messages:

Message Types:

• 'R' (0x52): Authentication
• 'S' (0x53): ParameterStatus (contains server_version)
• 'K' (0x4B): BackendKeyData
• 'Z' (0x5A): ReadyForQuery
• 'E' (0x45): ErrorResponse

ParameterStatus Format

Byte 0: 'S' (0x53)
Bytes 1-4: Message length (4 bytes, big-endian, includes length field)
Bytes 5+: Parameter name (null-terminated) + Value (null-terminated)

Version Extraction

#![allow(unused)]
fn main() {
// Scan for ParameterStatus messages with parameter "server_version"
if msg_type == b'S' {
    let length = u32::from_be_bytes(...);
    let content = &response[pos+5..pos+1+length];

    if param_name == "server_version" {
        // Extract value: "14.2 (Ubuntu 14.2-1ubuntu1)"
        version = parse_null_terminated_value(content);
    }
}
}

OS Detection

#![allow(unused)]
fn main() {
// "14.2 (Ubuntu 14.2-1ubuntu1)" → version="14.2", os="Ubuntu"
// "13.7 (Debian 13.7-1.pgdg110+1)" → version="13.7", os="Debian"
// "12.9 (Red Hat 12.9-1RHEL8)" → version="12.9", os="Red Hat Enterprise Linux"
}

Confidence Calculation

Base: 0.7
+ 0.15 if version extracted
+ 0.1 if OS hint found
Maximum: 1.0

Confidence Scoring

Scoring Philosophy

Confidence reflects information richness rather than detection certainty:

• 0.5-0.6: Basic detection (service identified, no version)
• 0.7-0.8: Good detection (service + version)
• 0.9-1.0: Excellent detection (service + version + OS + additional info)

Per-Protocol Ranges

Usage Examples

Basic Service Scan

# Scan with service detection enabled (default)
prtip -sS -sV -p 80,22,445,3306,5432 192.168.1.0/24

# Output format
PORT     STATE  SERVICE      VERSION
22/tcp   open   ssh          OpenSSH 8.2p1 (Ubuntu 20.04 LTS)
80/tcp   open   http         nginx/1.21.6 (Ubuntu)
445/tcp  open   microsoft-ds SMB 3.11 (Windows 10/2016+)
3306/tcp open   mysql        MySQL 8.0.27 (Ubuntu 20.04)
5432/tcp open   postgresql   PostgreSQL 14.2 (Ubuntu)

Advanced Service Detection

# Aggressive scan with all detection methods
prtip -A -p 1-1000 target.com

# Fast scan (disable protocol-specific detection)
prtip -sS -p- --no-service-detect target.com

# Service detection only (no port scan)
prtip -sV -p 80,443,8080 --no-ping target.com

Programmatic Usage

#![allow(unused)]
fn main() {
use prtip_core::detection::{
    HttpFingerprint, SshBanner, ProtocolDetector
};

// HTTP detection
let detector = HttpFingerprint::new();
if let Ok(Some(info)) = detector.detect(response) {
    println!("Service: {}", info.service);
    println!("Product: {:?}", info.product);
    println!("Version: {:?}", info.version);
    println!("Confidence: {:.2}", info.confidence);
}

// SSH detection
let detector = SshBanner::new();
if let Ok(Some(info)) = detector.detect(banner) {
    println!("Product: {:?}", info.product);
    println!("OS: {:?}", info.os_type);
}
}

Performance Characteristics

Overhead Analysis

Benchmarks

Sprint 5.2 introduces <1% overhead vs regex-only detection:

Regex-Only Detection:     5.1ms per target
Protocol + Regex:         5.15ms per target
Overhead:                 0.05ms (0.98%)

Scalability Features

• Zero allocations: Uses references and slices for maximum efficiency
• Early exit: Returns None immediately if magic bytes don't match
• Stateless: No shared mutable state, safe for concurrent use
• Fallback chain: Fast rejection before expensive regex matching

Integration

With Existing service_db.rs

Protocol-specific detection complements regex-based detection:

1. Priority Order: Protocol detectors run BEFORE regex matching
2. Higher Confidence: Protocol parsing provides more accurate version/OS info
3. Fallback: If protocol detection returns None, regex matching proceeds
4. Combination: Some services may match both (protocol takes precedence)

Detection Pipeline

#![allow(unused)]
fn main() {
// Pseudo-code for detection pipeline
fn detect_service(response: &[u8], port: u16) -> ServiceInfo {
    // 1. Try protocol-specific detection (priority order)
    for detector in [http, ssh, smb, mysql, postgresql] {
        if let Some(info) = detector.detect(response)? {
            return info; // High-confidence result
        }
    }

    // 2. Fallback to regex matching (service_db.rs)
    if let Some(info) = service_db.match_response(response, port) {
        return info; // Medium-confidence result
    }

    // 3. Generic detection (port-based)
    return generic_service_for_port(port); // Low-confidence result
}
}

Troubleshooting

Issue: Low Detection Rate

Symptom: Services detected as "unknown" despite known protocols

Possible Causes:

1. Firewall blocking probe packets
2. Service using non-standard banner format
3. Encrypted protocol (TLS/SSL wrapper)

Solutions:

# Try different probe types
prtip -sS -sV --probe-all target.com

# Disable TLS for HTTP services
prtip -sV --no-tls -p 443 target.com

# Verbose output shows detection attempts
prtip -sV -v target.com

Issue: Incorrect OS Detection

Symptom: Wrong OS version reported (e.g., Ubuntu 14.04 instead of 20.04)

Possible Causes:

1. Custom banner modification by admin
2. Container/virtualization masking host OS
3. Load balancer presenting different banner

Solutions:

• Cross-reference with other detection methods (TTL, TCP options)
• Use --os-fingerprint for active OS detection
• Verify banner format with manual connection: telnet target.com 22

Issue: Performance Degradation

Symptom: Service detection slower than expected

Possible Causes:

1. Too many concurrent probes
2. Network latency
3. Service rate limiting

Solutions:

# Reduce parallelism
prtip -sV --max-parallel 50 target.com

# Faster timing template (less accurate)
prtip -sV -T4 target.com

# Disable protocol-specific detection
prtip -sS --no-service-detect target.com

See Also

• OS Fingerprinting - Complementary OS detection
• Stealth Scanning - Low-profile service detection
• User Guide - Basic usage patterns
• Advanced Usage - Service detection use cases

References:

1. Nmap Service Probes: nmap-service-probes database (187 probes, 5,572 patterns)
2. RFC 4253: SSH Protocol Architecture
3. MS-SMB2: SMB 2 and 3 Protocol Specification
4. MySQL Protocol: Client/Server Protocol Documentation
5. PostgreSQL Protocol: Frontend/Backend Protocol Documentation

Sprint 5.2 Achievement:

• Detection rate improvement: +10-15pp (70-80% → 85-90%)
• Test coverage: 23 new unit tests (2,111 total passing as of Phase 6)
• Performance overhead: <1% vs regex-only detection
• New protocol modules: 5 (HTTP, SSH, SMB, MySQL, PostgreSQL)

Idle Scan (Zombie Scan)

Anonymous port scanning using a third-party "zombie" host.

What is Idle Scan?

Idle scan (also known as zombie scan) is an advanced stealth port scanning technique that uses a third-party "zombie" host to perform port scanning without revealing the scanner's IP address to the target. This technique was invented by Antirez and popularized by Nmap.

ProRT-IP Implementation:

• Maximum Stealth - Target sees traffic from zombie, not scanner
• Complete Anonymity - Scanner's IP never appears in target logs
• No Direct Connection - Scanner never sends packets to target
• IPID Exploitation - Uses IP ID sequence numbers for port state inference
• 99.5% Accuracy - Optimal conditions with excellent zombie host
• Nmap Compatible - Full -sI flag compatibility

Use Cases:

• Penetration Testing - Maximum anonymity during authorized engagements
• IDS/IPS Evasion - Evade systems that log source IP addresses
• Firewall Testing - Test firewall rules without direct exposure
• Security Research - Network reconnaissance and topology mapping
• Attribution Avoidance - Scanning from untrusted networks

When NOT to Use:

• ❌ High-speed scanning requirements (slower than direct methods)
• ❌ Modern OS targets (random IPID makes inference difficult)
• ❌ Networks without suitable zombie hosts
• ❌ Production scanning requiring reliability over stealth

How It Works

IP Identification (IPID) Field

The IP protocol header includes a 16-bit identification field used for reassembling fragmented packets. Many older operating systems implement this field with a globally incremental counter:

IP Header (simplified):
+----------------+----------------+
| Version | IHL  | Type of Service|
+----------------+----------------+
| Total Length                    |
+----------------+----------------+
| Identification (IPID)           |  ← We track this field
+----------------+----------------+
| Flags | Fragment Offset          |
+----------------+----------------+

Sequential IPID Behavior:

• Each outgoing packet increments IPID by 1
• IPID persists across all protocols (TCP, UDP, ICMP)
• IPID is global, not per-connection
• Predictable sequence allows remote observation

Example Sequence:

Zombie sends packet → IPID: 1000
Zombie sends packet → IPID: 1001
Zombie sends packet → IPID: 1002
...

The Three-Step Idle Scan Process

Step 1: Baseline IPID Probe

Scanner → Zombie (SYN/ACK)
Zombie → Scanner (RST, IPID: 1000)

Record baseline IPID: 1000

Step 2: Spoofed Scan

Scanner → Target (SYN, source: Zombie IP)
Target → Zombie (response depends on port state)

If port CLOSED:

Target → Zombie (RST)
Zombie → Target (no response, IPID unchanged)

If port OPEN:

Target → Zombie (SYN/ACK)
Zombie → Target (RST, IPID: 1001)

Step 3: Measure IPID Change

Scanner → Zombie (SYN/ACK)
Zombie → Scanner (RST, IPID: ???)

IPID Delta Interpretation:

• IPID 1001 (+1): Port CLOSED (zombie sent 1 packet: baseline probe response)
• IPID 1002 (+2): Port OPEN (zombie sent 2 packets: baseline probe + RST to target)
• IPID 1003+ (+3+): Traffic interference or zombie active use

Why This Works

1. No Direct Connection - Scanner never contacts target directly
2. IPID Side Channel - Zombie's IPID reveals its packet sending activity
3. Target Response Triggers - Open ports cause zombie to send RST
4. Inference Logic - IPID delta indicates zombie's unseen traffic

Modern IPID Randomization

Security Evolution:

• Linux kernel 4.18+ (2018): Random IPID by default
• Windows 10+: Random IPID per connection
• BSD systems: Per-flow IPID randomization

Why Randomization Breaks Idle Scan:

• IPID no longer predictable
• Cannot infer packet count from IPID delta
• Zombie hosts must be older systems or specifically configured

Usage

Basic Idle Scan

Specify zombie IP manually:

sudo prtip -sI 192.168.1.50 192.168.1.100

Explanation:

• -sI 192.168.1.50: Use 192.168.1.50 as zombie host
• 192.168.1.100: Target to scan
• Requires root/administrator privileges (raw sockets)

Expected Output:

[*] Using zombie host: 192.168.1.50
[*] Zombie IPID pattern: Sequential
[*] Scanning target: 192.168.1.100

PORT     STATE    SERVICE
22/tcp   open     ssh
80/tcp   open     http
443/tcp  open     https

Automated Zombie Discovery

Let ProRT-IP find a suitable zombie:

sudo prtip -sI auto --zombie-range 192.168.1.0/24 192.168.1.100

Explanation:

• -sI auto: Automatic zombie selection
• --zombie-range 192.168.1.0/24: Search for zombies in this range
• ProRT-IP tests all hosts for sequential IPID, selects best candidate

Expected Output:

[*] Discovering zombie hosts in 192.168.1.0/24...
[+] Found 3 candidates:
    - 192.168.1.50 (Excellent, 5ms)
    - 192.168.1.75 (Good, 15ms)
    - 192.168.1.120 (Fair, 45ms)
[*] Selected zombie: 192.168.1.50 (Excellent)
[*] Scanning target: 192.168.1.100
...

Zombie Quality Threshold

Only use high-quality zombies:

sudo prtip -sI auto --zombie-quality good 192.168.1.100

Quality Levels:

• excellent - <10ms response, stable IPID, zero interference
• good - <50ms response, sequential IPID, minimal interference
• fair - <100ms response, sequential IPID, acceptable interference
• poor - >100ms or unstable (not recommended)

Multiple Port Scanning

Scan specific ports:

sudo prtip -sI 192.168.1.50 -p 22,80,443,3389 192.168.1.100

Scan port range:

sudo prtip -sI 192.168.1.50 -p 1-1000 192.168.1.100

Fast scan (top 100 ports):

sudo prtip -sI 192.168.1.50 -F 192.168.1.100

Timing Control

Slower scan for stealthier operation:

sudo prtip -sI 192.168.1.50 -T2 192.168.1.100  # Polite timing

Faster scan (higher risk of interference):

sudo prtip -sI 192.168.1.50 -T4 192.168.1.100  # Aggressive timing

Timing Templates:

• T0 (Paranoid) - 5 minutes between probes
• T1 (Sneaky) - 15 seconds between probes
• T2 (Polite) - 0.4 seconds between probes (recommended)
• T3 (Normal) - Default, balanced approach
• T4 (Aggressive) - Fast, interference likely
• T5 (Insane) - Maximum speed, accuracy may suffer

Output Formats

XML output (Nmap-compatible):

sudo prtip -sI 192.168.1.50 -oX idle_scan.xml 192.168.1.100

JSON output:

sudo prtip -sI 192.168.1.50 -oJ idle_scan.json 192.168.1.100

Greppable output:

sudo prtip -sI 192.168.1.50 -oG idle_scan.gnmap 192.168.1.100

Combined with Other Techniques

Idle scan with service detection:

sudo prtip -sI 192.168.1.50 -sV 192.168.1.100

⚠️ Warning: Service detection requires direct connection, reducing anonymity

Idle scan with verbose output:

sudo prtip -sI 192.168.1.50 -v 192.168.1.100

Idle scan with debugging:

sudo prtip -sI 192.168.1.50 -vv --debug-zombie 192.168.1.100

Output includes:

• Baseline IPID values
• Delta measurements per port
• Timing information
• Traffic interference warnings

Zombie Host Requirements

Essential Requirements

1. Sequential IPID Assignment

MUST have globally incremental IPID:

✅ Good: 1000 → 1001 → 1002 → 1003 (sequential)
❌ Bad:  1000 → 5432 → 8765 → 2341 (random)

Test for sequential IPID:

# ProRT-IP automated test
sudo prtip -I 192.168.1.50

Expected Output:

IPID Pattern: Sequential (1000 → 1001 → 1002)
Quality: Excellent

2. Low Background Traffic

Zombie must be idle:

• No active users browsing/downloading
• No automated services (cron jobs, backups)
• Minimal incoming connections
• No peer-to-peer applications

Warning signs of high traffic:

• IPID delta >2 consistently
• Large IPID jumps between probes
• Inconsistent scan results

3. Consistent Response Time

Stable network path:

• <100ms response time preferred
• Low jitter (<20ms variance)
• No packet loss
• Direct network path (no NAT/proxy)

4. Responsive Service

Why we need a responsive port:

• Must respond to our baseline probes
• SYN/ACK probe triggers RST response
• Any port works (doesn't need to be "open")

Common responsive services:

• Port 80 (HTTP) - very common
• Port 22 (SSH) - Linux/Unix systems
• Port 443 (HTTPS) - web servers
• Port 3389 (RDP) - Windows systems

Operating System Compatibility

✅ Suitable Operating Systems

Old Linux Kernels (pre-4.18):

# Check kernel version
uname -r

# Example suitable versions:
- Ubuntu 16.04 (kernel 4.4)
- CentOS 7 (kernel 3.10)
- Debian 8 (kernel 3.16)

Windows Versions (pre-Windows 10):

• Windows XP
• Windows 7
• Windows Server 2003/2008

Embedded Devices:

• Network printers (HP, Canon, Brother)
• Old routers/switches (Linksys, Netgear)
• IoT devices with old firmware
• Surveillance cameras (Axis, Hikvision)
• VoIP phones

Virtualized Systems (sometimes):

• Some VMs inherit host IPID behavior
• Depends on hypervisor and guest OS
• Test before relying on VM zombies

❌ Unsuitable Operating Systems

Modern Linux (kernel 4.18+):

# Since 2018, random IPID by default
# Can be reverted (not recommended for security):
sysctl -w net.ipv4.ip_no_pmtu_disc=1

Windows 10 and Later:

• Per-connection random IPID
• Cannot be disabled
• Enterprise editions same behavior

Modern BSD:

• FreeBSD 11+
• OpenBSD 6+
• Per-flow IPID randomization

macOS:

• All versions use random IPID
• Never suitable as zombie

Zombie Discovery Strategies

Strategy 1: Network Sweep

Scan for old systems:

# Discover Linux kernel versions
sudo prtip -O 192.168.1.0/24 | grep "Linux 2\|Linux 3"

# Find Windows versions
sudo prtip -O 192.168.1.0/24 | grep "Windows XP\|Windows 7"

Strategy 2: Embedded Device Targeting

Common embedded device ranges:

# Printers (often 192.168.1.100-150)
sudo prtip -I 192.168.1.100-150

# Cameras (often 192.168.1.200-250)
sudo prtip -I 192.168.1.200-250

Strategy 3: Automated Discovery

Use ProRT-IP's built-in discovery:

# Scan entire /24 for suitable zombies
sudo prtip -I --zombie-range 192.168.1.0/24 --zombie-quality good

Expected Output: