[sf-lug] Cool little security check

[Rick Moen]

Quoting Michael Paoli (Michael.Paoli at cal.berkeley.edu):

> Heck, if you've got regular login access on the host, why bother to go
> so far as to scan with nmap?  One could use something like:
> $ ss -nlf inet -f inet6
> Or if you've got superuser ("root") access, add the -p option too
> to also get the responsible process information at the same time:
> # ss -nlpf inet -f inet6

Word.  Having ss or netstat's list of which interface is listeing on
which ports is extremely useful.

The two obvious use-cases where you'd be better off using nmap from a
network-nearby host are:

(1) You don't want to rely on the security of the target host, but
rather observe its network-presence profile from a machine you trust, or

(2) The target machine runs a sucky operating system, e.g., MS-Windows,
and you just don't want the pain of trying to run real network tools on
it.

But, let's face it, this all traces to the unnamed Devuan poster buying
Steve Gibson's rather dumb idea, encoded into ShieldsUp, that it's
A Good Thing[tm] to be totally invisible to port-scanning -- like in
Monty Python's 'How Not to Be Seen' skit:
https://www.youtube.com/watch?v=ifmRgQX82O4