20.13 |
Category: |
0
comments
Andrew J. Bennieston
http://nmap.org/bennieston-tutorial/
Contents
1 Introduction
Nmap is a free, open-source port scanner available for both UNIX and Windows. It has an optional graphical front-end, NmapFE, and supports a wide variety of scan types, each one with different benefits and drawbacks.
This article describes some of these scan types, explaining their relative benefits and just how they actually work. It also offers tips about which types of scan would be best against which types of host.
The article assumes you have Nmap installed (or that you know how to install it. Instructions are available on the Nmap website, http://www.insecure.org/nmap/install/inst-source.html ), and that you have the required privileges to run the scans detailed (many scans require root or Administrator privileges).
A frequently asked questions section has been added since the first version of this article, and this is included as the last section in this version. This is a fully revised and updated version of this tutorial, re-typed and converted to a TeX format, allowing more output formats to be utilised. At the time of writing, the latest Nmap version was 4.11.
2 Disclaimer
This information is provided to assist users of Nmap in scanning their own networks, or networks for which they have been given permission to scan, in order to determine the security of such networks. it is not intended to assist with scanning remote sites with the intention of breaking into or exploiting services on those sites, or for imformation gathering purposes beyond those allowed by law. I hereby disclaim any responsibility for actions taken based upon the information in this article, and urge all who seek information towards a destructive end to reconsider their life, and do something constructive instead.
3 Basic Scan Types [-sT, -sS]
The two basic scan types used most in Nmap are TCP connect() scanning [-sT] and SYN scanning (also known as half-open, or stealth scanning) [-sS].
These two types are explained in detail below.
3.1 TCP connect() Scan [-sT]
These scans are so called because UNIX sockets programming uses a system call named connect() to begin a TCP connection to a remote site. If connect() succeeds, a connection was made. If it fails, the connection could not be made (the remote system is offline, the port is closed, or some other error occurred along the way). This allows a basic type of port scan, which attempts to connect to every port in turn, and notes whether or not the connection succeeded. Once the scan is completed, ports to which a connection could be established are listed as open, the rest are said to be closed.
This method of scanning is very effective, and provides a clear picture of the ports you can and cannot access. If a connect() scan lists a port as open, you can definitely connect to it - that is what the scanning computer just did! There is, however, a major drawback to this kind of scan; it is very easy to detect on the system being scanned. If a firewall or intrusion detection system is running on the victim, attempts to connect() to every port on the system will almost always trigger a warning. Indeed, with modern firewalls, an attempt to connect to a single port which has been blocked or has not been specifically "opened" will usually result in the connection attempt being logged. Additionally, most servers will log connections and their source IP, so it would be easy to detect the source of a TCP connect() scan.
For this reason, the TCP Stealth Scan was developed.
3.2 SYN Stealth Scan [-sS]
I’ll begin this section with an overview of the TCP connection process. Those familiar with TCP/IP can skip the first few paragraphs.
When a TCP connection is made between two systems, a process known as a "three way handshake" occurs. This involves the exchange of three packets, and synchronises the systems with each other (necessary for the error correction built into TCP. Refer to a good TCP/IP book for more details.
The system initiating the connection sends a packet to the system it wants to connect to. TCP packets have a header section with a flags field. Flags tell the receiving end something about the type of packet, and thus what the correct response is.
Here, I will talk about only four of the possible flags. These are SYN (Synchronise), ACK (Acknowledge), FIN (Finished) and RST (Reset). SYN packets include a TCP sequence number, which lets the remote system know what sequence numbers to expect in subsequent communication. ACK acknowledges receipt of a packet or set of packets, FIN is sent when a communication is finished, requesting that the connection be closed, and RST is sent when the connection is to be reset (closed immediately).
To initiate a TCP connection, the initiating system sends a SYN packet to the destination, which will respond with a SYN of its own, and an ACK, acknowledging the receipt of the first packet (these are combined into a single SYN/ACK packet). The first system then sends an ACK packet to acknowledge receipt of the SYN/ACK, and data transfer can then begin.
SYN or Stealth scanning makes use of this procedure by sending a SYN packet and looking at the response. If SYN/ACK is sent back, the port is open and the remote end is trying to open a TCP connection. The scanner then sends an RST to tear down the connection before it can be established fully; often preventing the connection attempt appearing in application logs. If the port is closed, an RST will be sent. If it is filtered, the SYN packet will have been dropped and no response will be sent. In this way, Nmap can detect three port states - open, closed and filtered. Filtered ports may require further probing since they could be subject to firewall rules which render them open to some IPs or conditions, and closed to others.
Modern firewalls and Intrusion Detection Systems can detect SYN scans, but in combination with other features of Nmap, it is possible to create a virtually undetectable SYN scan by altering timing and other options (explained later).
4 FIN, Null and Xmas Tree Scans [-sF, -sN, -sX]
With the multitude of modern firewalls and IDS’ now looking out for SYN scans, these three scan types may be useful to varying degrees. Each scan type refers to the flags set in the TCP header. The idea behind these type of scans is that a closed port should respond with an RST upon receiving packets, whereas an open port should just drop them (it’s listening for packets with SYN set). This way, you never make even part of a connection, and never send a SYN packet; which is what most IDS’ look out for.
The FIN scan sends a packet with only the FIN flag set, the Xmas Tree scan sets the FIN, URG and PUSH flags (see a good TCP/IP book for more details) and the Null scan sends a packet with no flags switched on.
These scan types will work against any system where the TCP/IP implementation follows RFC 793. Microsoft Windows does not follow the RFC, and will ignore these packets even on closed ports. This technicality allows you to detect an MS Windows system by running SYN along with one of these scans. If the SYN scan shows open ports, and the FIN/NUL/XMAS does not, chances are you’re looking at a Windows box (though OS Fingerprinting is a much more reliable way of determining the OS running on a target!)
The sample below shows a SYN scan and a FIN scan, performed against a Linux system. The results are, predictably, the same, but the FIN scan is less likely to show up in a logging system.
1 [chaos]# nmap -sS 127.0.0.1
2
3 Starting Nmap 4.01 at 2006-07-06 17:23 BST
4 Interesting ports on chaos (127.0.0.1):
5 (The 1668 ports scanned but not shown below are in state:
6 closed)
7 PORT STATE SERVICE
8 21/tcp open ftp
9 22/tcp open ssh
10 631/tcp open ipp
11 6000/tcp open X11
12
13 Nmap finished: 1 IP address (1 host up) scanned in 0.207
14 seconds
15 [chaos]# nmap -sF 127.0.0.1
16
17 Starting Nmap 4.01 at 2006-07-06 17:23 BST
18 Interesting ports on chaos (127.0.0.1):
19 (The 1668 ports scanned but not shown below are in state:
20 closed)
21 PORT STATE SERVICE
22 21/tcp open|filtered ftp
23 22/tcp open|filtered ssh
24 631/tcp open|filtered ipp
25 6000/tcp open|filtered X11
26
27 Nmap finished: 1 IP address (1 host up) scanned in 1.284
28 seconds
5 Ping Scan [-sP]
This scan type lists the hosts within the specified range that responded to a ping. It allows you to detect which computers are online, rather than which ports are open. Four methods exist within Nmap for ping sweeping.
The first method sends an ICMP ECHO REQUEST (ping request) packet to the destination system. If an ICMP ECHO REPLY is received, the system is up, and ICMP packets are not blocked. If there is no response to the ICMP ping, Nmap will try a "TCP Ping", to determine whether ICMP is blocked, or if the host is really not online.
A TCP Ping sends either a SYN or an ACK packet to any port (80 is the default) on the remote system. If RST, or a SYN/ACK, is returned, then the remote system is online. If the remote system does not respond, either it is offline, or the chosen port is filtered, and thus not responding to anything.
When you run an Nmap ping scan as root, the default is to use the ICMP and ACK methods. Non-root users will use the connect() method, which attempts to connect to a machine, waiting for a response, and tearing down the connection as soon as it has been established (similar to the SYN/ACK method for root users, but this one establishes a full TCP connection!)
The ICMP scan type can be disabled by setting -P0 (that is, zero, not uppercase o).
6 UDP Scan [-sU]
Scanning for open UDP ports is done with the -sU option. With this scan type, Nmap sends 0-byte UDP packets to each target port on the victim. Receipt of an ICMP Port Unreachable message signifies the port is closed, otherwise it is assumed open.
One major problem with this technique is that, when a firewall blocks outgoing ICMP Port Unreachable messages, the port will appear open. These false-positives are hard to distinguish from real open ports.
Another disadvantage with UDP scanning is the speed at which it can be performed. Most operating systems limit the number of ICMP Port Unreachable messages which can be generated in a certain time period, thus slowing the speed of a UDP scan. Nmap adjusts its scan speed accordingly to avoid flooding a network with useless packets. An interesting point to note here is that Microsoft do not limit the Port Unreachable error generation frequency, and thus it is easy to scan a Windows machine’s 65,535 UDP Ports in very little time!!
UDP Scanning is not usually useful for most types of attack, but it can reveal information about services or trojans which rely on UDP, for example SNMP, NFS, the Back Orifice trojan backdoor and many other exploitable services.
Most modern services utilise TCP, and thus UDP scanning is not usually included in a pre-attack information gathering exercise unless a TCP scan or other sources indicate that it would be worth the time taken to perform a UDP scan.
7 IP Protocol Scans [-sO]
The IP Protocol Scans attempt to determine the IP protocols supported on a target. Nmap sends a raw IP packet without any additional protocol header (see a good TCP/IP book for information about IP packets), to each protocol on the target machine. Receipt of an ICMP Protocol Unreachable message tells us the protocol is not in use, otherwise it is assumed open. Not all hosts send ICMP Protocol Unreachable messages. These may include firewalls, AIX, HP-UX and Digital UNIX). These machines will report all protocols open.
This scan type also falls victim to the ICMP limiting rate described in the UDP scans section, however since only 256 protocols are possible (8-bit field for IP protocol in the IP header) it should not take too long.
Results of an -sO on my Linux workstation are included below.
1 [chaos]# nmap -sO 127.0.0.1
2
3 Starting Nmap 4.01 at 2006-07-14 12:56 BST
4 Interesting protocols on chaos(127.0.0.1):
5 (The 251 protocols scanned but not shown below are
6 in state: closed)
7 PROTOCOL STATE SERVICE
8 1 open icmp
9 2 open|filtered igmp
10 6 open tcp
11 17 open udp
12 255 open|filtered unknown
13
14 Nmap finished: 1 IP address (1 host up) scanned in
15 1.259 seconds
8 Idle Scanning [-sI]
Idle scanning is an advanced, highly stealthed technique, where no packets are sent to the target which can be identified to originate from the scanning machine. A zombie host (and optionally port) must be specified for this scan type. The zombie host must satisfy certain criteria essential to the workings of this scan.
This scan type works by exploiting "predictable IP fragmentation ID" sequence generation on the zombie host, to determine open ports on the target. The scan checks the IPID on the zombie, then spoofs a connection request to the target machine, making it appear to come from the zombie. If the target port is open, a SYN/ACK session acknowledgement will be sent from the target machine back to the zombie, which will RST the connection since it has no record of having opened such a connection. If the port on the target is closed, an RST will be sent to the zombie, and no further packets will be sent. The attacker then checks the IPID on the zombie again. If it has incremented by 2 (or changed by two steps in its sequence), this corresponds to the packet received from the target, plus the RST from the zombie, which equates to an open port on the target. If the IPID has changed by one step, an RST was received from the target and no further packets were sent.
Using this mechanism, it is possible to scan every port on a target, whilst making it appear that the zombie was the one doing the scanning. Of course, the spoofed connection attempts will likely be logged, so the target system will have the zombie IP address, and the zombie system’s logs are likely to contain the attacker’s IP address, so it is still possible, after acquiring logs through legal channels, to determine the attacker, but this method makes it much more difficult to do so than if the packets were sent directly from the attacker. In addition, some IDS and firewall software makes attempts to detect spoofed packets based on the network they arrive from. As long as the zombie host and the attacker are both "out on the Internet", or on the same network as each other, relative to the target, techniques to identify spoofed packets are not likely to succeed.
This scan type requires certain things of the zombie. The IPID sequence generation must be predictable (single-step increments, for example). The host must also have low traffic so that it is unlikely for other packets to hit the zombie whilst Nmap is carrying out its scan (as these will artificially inflate the IPID number!). Cheap routers or MS Windows boxes make good zombie hosts. Most operating systems use randomised sequence numbers (see the OS Fingerprinting section for details on how to check a target’s sequence generation type).
The idle scan can also be used to determine IP trust based relationships between hosts (e.g. a firewall may allow a certain host to connect to port x, but not other hosts). This scan type can help to determine which hosts have access to such a system.
For more information about this scan type, read http://www.insecure.org/nmap/idlescan.html
9 Version Detection [-sV]
Version Detection collects information about the specific service running on an open port, including the product name and version number. This information can be critical in determining an entry point for an attack. The -sV option enables version detection, and the -A option enables both OS fingerprinting and version detection, as well as any other advanced features which may be added in future releases.
Version detection is based on a complex series of probes, detailed in the Version Detection paper at http://www.insecure.org/nmap/vscan/
10 ACK Scan [-sA]
Usually used to map firewall rulesets and distinguish between stateful and stateless firewalls, this scan type sends ACK packets to a host. If an RST comes back, the port is classified "unfiltered" (that is, it was allowed to send its RST through whatever firewall was in place). If nothing comes back, the port is said to be "filtered". That is, the firewall prevented the RST coming back from the port. This scan type can help determine if a firewall is stateless (just blocks incoming SYN packets) or stateful (tracks connections and also blocks unsolicited ACK packets).
Note that an ACK scan will never show ports in the "open" state, and so it should be used in conjunction with another scan type to gain more information about firewalls or packet filters between yourself and the victim.
11 Window Scan, RPC Scan, List Scan [-sW, -sR, -sL]
The TCP Window scan is similar to the ACK scan but can sometimes detect open ports as well as filtered/unfiltered ports. This is due to anomalies in TCP Window size reporting by some operating systems (see the Nmap manual for a list, or the nmap-hackers mailing list for the full list of susceptible OS’).
RPC Scans can be used in conjunction with other scan types to try to determine if an open TCP or UDP port is an RPC service, and if so, which program, and version numbers are running on it. Decoys are not supported with RPC scans (see section on Timing and Hiding Scans, below).
List scanning simply prints a list of IPs and names (DNS resolution will be used unless the -n option is passed to Nmap) without actually pinging or scanning the hosts.
12 Timing and Hiding Scans
12.1 Timing
Nmap adjusts its timings automatically depending on network speed and response times of the victim. However, you may want more control over the timing in order to create a more stealthy scan, or to get the scan over and done with quicker.
The main timing option is set through the -T parameter. There are six predefined timing policies which can be specified by name or number (starting with 0, corresponding to Paranoid timing). The timings are Paranoid, Sneaky, Polite, Normal, Aggressive and Insane.
A -T Paranoid (or -T0) scan will wait (generally) at least 5 minutes between each packet sent. This makes it almost impossible for a firewall to detect a port scan in progress (since the scan takes so long it would most likely be attributed to random network traffic). Such a scan will still show up in logs, but it will be so spread out that most analysis tools or humans will miss it completely.
A -T Insane (or -T5) scan will map a host in very little time, provided you are on a very fast network or don’t mind losing some information along the way.
Timings for individual aspects of a scan can also be set using the –host_timeout, –max_rtt_timeout, –min_rtt_timeout, –initial_rtt_timeout, –max_parallelism, –min_parallelism, and –scan_delay options. See the Nmap manual for details.
12.2 Decoys
The -D option allows you to specify Decoys. This option makes it look like those decoys are scanning the target network. It does not hide your own IP, but it makes your IP one of a torrent of others supposedly scanning the victim at the same time. This not only makes the scan look more scary, but reduces the chance of you being traced from your scan (difficult to tell which system is the "real" source).
12.3 FTP Bounce
The FTP protocol (RFC 959) specified support for a "proxy" ftp, which allowed a connection to an FTP server to send data to anywhere on the internet. This tends not to work with modern ftpds, in which it is an option usually disabled in the configuration. If a server with this feature is used by Nmap, it can be used to try to connect to ports on your victim, thus determining their state.
This scan method allows for some degree of anonymity, although the FTP server may log connections and commands sent to it.
12.4 Turning Off Ping
The -P0 (that’s a zero) option allows you to switch off ICMP pings. The -PT option switches on TCP Pings, you can specify a port after the -PT option to be the port to use for the TCP ping.
Disabling pings has two advantages: First, it adds extra stealth if you’re running one of the more stealthy attacks, and secondly it allows Nmap to scan hosts which don’t reply to pings (ordinarily, Nmap would report those hosts as being "down" and not scan them).
In conjunction with -PT, you can use -PS to send SYN packets instead of ACK packets for your TCP Ping.
The -PU option (with optional port list after) sends UDP packets for your "ping". This may be best to send to suspected-closed ports rather than open ones, since open UDP ports tend not to respond to zero-length UDP packets.
Other ping types are -PE (Standard ICMP Echo Request), -PP (ICMP Timestamp Request), -PM (Netmask Request) and -PB (default, uses both ICMP Echo Request and TCP ping, with ACK packets)
12.5 Fragmenting
The -f option splits the IP packet into tiny fragments when used with -sS, -sF, -sX or -sN. This makes it more difficult for a firewall or packet filter to determine the packet type. Note that many modern packet filters and firewalls (including iptables) feature optional defragmenters for such fragmented packets, and will thus reassemble the packet to check its type before sending it on. Less complex firewalls will not be able to cope with fragmented packets this small and will most likely let the OS reassemble them and send them to the port they were intended to reach. Using this option could crash some less stable software and hardware since packet sizes get pretty small with this option!
12.6 Idle Scanning
See the section on -sI for information about idle scans.
13 OS Fingerprinting
The -O option turns on Nmap’s OS fingerprinting system. Used alongside the -v verbosity options, you can gain information about the remote operating system and about its TCP Sequenmce Number generation (useful for planning Idle scans).
An article on OS detection is available at http://www.insecure.org/nmap/nmap-fingerprinting-article.html
14 Outputting Logs
Logging in Nmap can be provided by the -oN, -oX or -oG options. Each one is followed by the name of the logfile. -oN outputs a human readable log, -oX outputs an XML log and -oG outputs a grepable log. The -oA option outputs in all 3 formats, and -oS outputs in a format I’m sure none of you would ever want to use (try it; you’ll see what I mean!)
The –append-output option appends scan results to the output files you specified instead of overwriting their contents.
15 Other Nmap Options
15.1 IPv6
The -6 option enables IPv6 in Nmap (provided your OS has IPv6 support). Currently only TCP connect, and TCP connect ping scan are supported. For other scantypes, see http://nmap6.sourceforge.net
15.2 Verbose Mode
Highly recommended, -v
Use -v twice for more verbosity. The option -d can also be used (once or twice) to generate more verbose output.
15.3 Resuming
Scans cancelled with Ctrl+C can be resumed with the --resume option. The logfile must be a Normal or Grepable logfile (-oN or -oG).
15.4 Reading Targets From A File
-iL reads targets from inputfilename rather than from the command-line.
The file should contain a hostlist or list of network expressions separated by spaces, tabs or newlines. Using a hyphen as inputfile makes Nmap read from standard input.
15.5 Fast Scan
The -F option scans only those ports listed in the nmap_services file (or the protocols file if the scan type is -sO). This is far faster than scanning all 65,535 ports!!
15.6 Time-To-Live
The -ttl option sets the IPv4 packets time-to-live. The usefulness of this is in mapping paths through networks and determining ACL’s on firewalls (setting the ttl to one past the packet filter can help to determine information about the filtering rules themselves). Repeated Nmap scans to a single port using differing ttl values will emulate a traceroute style network path map (Try it, its great fun for a while, until you get bored and realise traceroute does it all for you automatically!).
16 Typical Scanning Session
First, we’ll sweep the network with a simple Ping scan to determine which hosts are online.
1 [chaos]# nmap -sP 10.0.0.0/24
2
3 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at
4 2006-07-14 14:19 BST
5 Host 10.0.0.1 appears to be up.
6 MAC Address: 00:09:5B:29:FD:96 (Netgear)
7 Host 10.0.0.2 appears to be up.
8 MAC Address: 00:0F:B5:96:38:5D (Netgear)
9 Host 10.0.0.4 appears to be up.
10 Host 10.0.0.5 appears to be up.
11 MAC Address: 00:14:2A:B1:1E:2E (Elitegroup Computer System Co.)
12 Nmap finished: 256 IP addresses (4 hosts up) scanned in 5.399 seconds
Now we’re going to take a look at 10.0.0.1 and 10.0.0.2, both listed as Netgear in the ping sweep. These IPs are good criteria for routers (in fact I know that 10.0.0.1 is a router and 10.0.0.2 is a wireless access point, since it’s my network, but lets see what Nmap makes of it...)
We’ll scan 10.0.0.1 using a SYN scan [-sS] and -A to enable OS fingerprinting and version detection.
1 [chaos]# nmap -sS -A 10.0.0.1
2
3 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at
4 2006-07-14 14:23 BST
5 Insufficient responses for TCP sequencing (0),
6 OS detection may be less accurate
7 Interesting ports on 10.0.0.1:
8 (The 1671 ports scanned but not shown below are in state:
9 closed)
10 PORT STATE SERVICE VERSION
11 80/tcp open tcpwrapped
12 MAC Address: 00:09:5B:29:FD:96 (Netgear)
13 Device type: WAP
14 Running: Compaq embedded, Netgear embedded
15 OS details: WAP: Compaq iPAQ Connection Point or
16 Netgear MR814
17
18 Nmap finished: 1 IP address (1 host up) scanned in
19 3.533 seconds
The only open port is 80/tcp - in this case, the web admin interface for the router. OS fingerprinting guessed it was a Netgear Wireless Access Point - in fact this is a Netgear (wired) ADSL router. As it said, though, there were insufficient responses for TCP sequencing to accurately detect the OS.
Now we’ll do the same for 10.0.0.2...
1 [chaos]# nmap -sS -A 10.0.0.2
2
3 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ )
4 at 2006-07-14 14:26 BST
5 Interesting ports on 10.0.0.2:
6 (The 1671 ports scanned but not shown below are in state:
7 closed)
8 PORT STATE SERVICE VERSION
9 80/tcp open http Boa HTTPd 0.94.11
10 MAC Address: 00:0F:B5:96:38:5D (Netgear)
11 Device type: general purpose
12 Running: Linux 2.4.X|2.5.X
13 OS details: Linux 2.4.0 - 2.5.20
14 Uptime 14.141 days (since Fri Jun 30 11:03:05 2006)
15
16 Nmap finished: 1 IP address (1 host up) scanned in 9.636
17 seconds
Interestingly, the OS detection here listed Linux, and the version detection was able to detect the httpd running. The accuracy of this is uncertain, this is a Netgear home wireless access point, so it could be running some embedded Linux!
Now we’ll move on to 10.0.0.4 and 10.0.0.5, these are likely to be normal computers running on the network...
1 [chaos]# nmap -sS -P0 -A -v 10.0.0.4
2
3 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at
4 2006-07-14 14:31 BST
5 DNS resolution of 1 IPs took 0.10s. Mode:
6 Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
7 Initiating SYN Stealth Scan against 10.0.0.4 [1672 ports] at 14:31
8 Discovered open port 21/tcp on 10.0.0.4
9 Discovered open port 22/tcp on 10.0.0.4
10 Discovered open port 631/tcp on 10.0.0.4
11 Discovered open port 6000/tcp on 10.0.0.4
12 The SYN Stealth Scan took 0.16s to scan 1672 total ports.
13 Initiating service scan against 4 services on 10.0.0.4 at 14:31
14 The service scan took 6.01s to scan 4 services on 1 host.
15 For OSScan assuming port 21 is open, 1 is closed, and neither are
16 firewalled
17 Host 10.0.0.4 appears to be up ... good.
18 Interesting ports on 10.0.0.4:
19 (The 1668 ports scanned but not shown below are in state: closed)
20 PORT STATE SERVICE VERSION
21 21/tcp open ftp vsftpd 2.0.3
22 22/tcp open ssh OpenSSH 4.2 (protocol 1.99)
23 631/tcp open ipp CUPS 1.1
24 6000/tcp open X11 (access denied)
25 Device type: general purpose
26 Running: Linux 2.4.X|2.5.X|2.6.X
27 OS details: Linux 2.4.0 - 2.5.20, Linux 2.5.25 - 2.6.8 or
28 Gentoo 1.2 Linux 2.4.19 rc1-rc7
29 TCP Sequence Prediction: Class=random positive increments
30 Difficulty=4732564 (Good luck!)
31 IPID Sequence Generation: All zeros
32 Service Info: OS: Unix
33
34 Nmap finished: 1 IP address (1 host up) scanned in 8.333 seconds
35 Raw packets sent: 1687 (74.7KB) | Rcvd: 3382 (143KB)
From this, we can deduce that 10.0.0.4 is a Linux system (in fact, the one I’m typing this tutorial on!) running a 2.4 to 2.6 kernel (Actually, Slackware Linux 10.2 on a 2.6.19.9 kernel) with open ports 21/tcp, 22/tcp, 631/tcp and 6000/tcp. All but 6000 have version information listed. The scan found the IPID sequence to be all zeros, which makes it useless for idle scanning, and the TCP Sequence prediction as random positive integers. The -v option is needed to get Nmap to print the IPID information out!
Now, onto 10.0.0.5...
1 [chaos]# nmap -sS -P0 -A -v 10.0.0.5
2
3 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ )
4 at 2006-07-14 14:35 BST
5 Initiating ARP Ping Scan against 10.0.0.5 [1 port] at 14:35
6 The ARP Ping Scan took 0.01s to scan 1 total hosts.
7 DNS resolution of 1 IPs took 0.02s. Mode: Async
8 [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
9 Initiating SYN Stealth Scan against 10.0.0.5 [1672 ports] at 14:35
10 The SYN Stealth Scan took 35.72s to scan 1672 total ports.
11 Warning: OS detection will be MUCH less reliable because we did
12 not find at least 1 open and 1 closed TCP port
13 Host 10.0.0.5 appears to be up ... good.
14 All 1672 scanned ports on 10.0.0.5 are: filtered
15 MAC Address: 00:14:2A:B1:1E:2E (Elitegroup Computer System Co.)
16 Too many fingerprints match this host to give specific OS details
17 TCP/IP fingerprint:
18 SInfo(V=4.01%P=i686-pc-linux-gnu%D=7/14%Tm=44B79DC6%O=-1%C=-1%M=00142A)
19 T5(Resp=N)
20 T6(Resp=N)
21 T7(Resp=N)
22 PU(Resp=N)
23
24 Nmap finished: 1 IP address (1 host up) scanned in 43.855 seconds
25 Raw packets sent: 3369 (150KB) | Rcvd: 1 (42B)
No open ports, and Nmap couldn’t detect the OS. This suggests that it is a firewalled or otherwise protected system, with no services running (and yet it responded to ping sweeps).
We now have rather more information about this network than we did when we started, and can guess at several other things based on these results. Using that information, and the more advanced Nmap scans, we can obtain further scan results which will help to plan an attack, or to fix weaknesses, in this network.
17 Frequently Asked Questions
This section was added as an extra to the original tutorial as it became popular and some questions were asked about particular aspects of an nmap scan. I’ll use this part of the tutorial to merge some of those into the main tutorial itself.
17.1 I tried a scan and it appeared in firewall logs or alerts. What else can I do to help hide my scan?
This question assumes you used a scan command along the lines of:
1 nmap -sS -P0 -p 1-140 -O -D xxx.xxx.xxx.xxx,
2 xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx -sV xxx.xx.xxx.xxx
Note: Each xxx corresponds to an octet of the IP address/addresses. This is instructing NMAP to run a Stealth scan (-sS) without pinging (-P0) on ports 1 to 140 (-p 1-140), to use OS Detection (-O) and to use Decoys (-D). The three comma-separated IPs are the decoy IPs to use. It also specifies to use version scanning (-sV) which attempts to determine precisely which program is running on a port.
Now, heres the analysis of this command: A stealth scan (-sS) is often picked up by most firewalls and IDS systems nowdays. It was originally designed to prevent logging of a scan in the logs for whatever server is running on the port the scanner connects to. In other words, if the scan connects to port 80 to test if its open, Apache (or whatever other webserver they may be using) will log the connection in its logfiles.
The -sS scan option doesn’t make a full TCP connect (which can be achieved with the -sT option, or by not running as root) but resets the connection before it can be fully established. As such, most servers will not log the connection, but an IDS or firewall will recognise this behaviour (in repeated cases) as typical of a port scan. This will mean that the scan shows up in firewall or IDS logs and alerts. There are few ways around this, to be honest. Most firewall/IDS software nowdays is quite good at detecting these things; particularly if its running on the same host as the victim (the system you are scanning).
Note also, that decoys will not prevent your IP showing entirely; it just lists the others as well. A particularly well designed IDS may even be able to figure out which is the real source of the scans.
Where speed of scan isn’t essential, the -P0 option is a good idea. Nmap gains timing information from pinging the host, and can often complete its scans faster with this information, but the ping packets will be sent to the victim from your IP, and any IDS worth its CPU cycles will pick up on the pattern of a few pings followed by connects to a variety of ports. -P0 also allows scanning of hosts which do not respond to pings (i.e. if ICMP is blocked by a firewall or by in-kernel settings).
I mentioned timing in the above paragraph. You can use the -T timing option to slow the scan down. The slower a scan is, the less likely it is to be detected by an IDS. There are bound to be occasional random connects occurring, people type an IP in wrong or try to connect and their computer crashes half way through the connect. These things happen, and unless an IDS is configured extremely strictly, they generally aren’t reported (at least, not in the main alert logs, they may be logged if logging of all traffic is enabled, but typically these kind of logs are only checked if theres evidence of something going on). Setting the timing to -T 0 or -T 1 (Paranoid or Sneaky) should help avoid detection. As mentioned in my main tutorial, you can also set timing options for each aspect of a scan,
Timings for individual aspects of a scan can also be set using the –host_timeout, –max_rtt_timeout, –min_rtt_timeout, –initial_rtt_timeout, –max_parallelism, –min_parallelism, and –scan_delay options. See the Nmap manual for details.
The final note I will add to this answer is that use of the Idle scan method (-sI) means that not a single packet is sent to the victim from your IP (provided you also use the -P0 option to turn off pings). This is the ultimate in stealth as there is absolutely no way the victim can determine that your IP is responsible for the scan (short of obtaining log information from the host you used as part of your idle scan).
17.2 NMAP seems to have stopped, or my scan is taking a very long while. Why is this?
The timing options can make it take a very long time. I believe the -T Paranoid ( -T 0 )option waits up to 5 minutes between packets... now, for 65000 ports, thats 65000 x 5 = 325000 minutes = 225 days!!
-T Sneaky ( -T 1 ) waits up to 15 seconds between scans, and is therefore more useful; but scans will still take a long while! You can use -v to get more verbose output, which will alert you as to the progress of the scan. Using -v twice makes the output even more verbose.
17.3 Will -sN -sX and -sF work against any host, or just Windows hosts?
-sN -sX and -sF scans will work against any host, but Windows computers do not respond correctly to them, so scanning a Windows machine with these scans results in all ports appearing closed. Scanning a *nix or other system should work just fine, though. As I said in the main tutorial, -sX -sF and -sN are commonly used to determine if you’re scanning a Windows host or not, without using the -O fingerprinting option.
The Nmap manual page should help to determine which scans work alongside which options, and on which target systems they are most effective.
17.4 How do I find a dummy host for the Idle Scan (-sI)?
You simply have to scan for hosts using sequential IPID sequences, these are (often) suitable for use as a dummy host for the -sI Idle Scan.
17.5 What does "Host seems down. If it is really up, but blocking our ping probes, try -P0" mean?
When Nmap starts, it tries to ping the host to check that it is online. Nmap also gains timing information from this ping. If the remote host, or a system on the path between you and the remote host, is blocking pings, this ping will not be replied to, and Nmap will not start scanning. Using the -P0 option, you can turn off ping-on-start and have Nmap try to scan anyway.
17.6 Where can I find NmapFE?
NmapFE is a graphical front-end for Nmap.
NmapFE for UNIX/Linux is included in the Nmap source. NmapFE for OSX is available at http://faktory.org/m/software/nmap/ NmapFE for Windows is under development as part of NmapFE++, a new frontend for Linux, OSX and Windows. Information is available at http://www.insecure.org/nmap/SoC/NmapFE.html
18 About This Document
This document is copyright ©2003-2009, Andrew J. Bennieston. This document is provided in several formats, including LaTeX source, and it may be freely redistributed in any form, providing no changes are made to the content. The latest version can always be found at http://nmap.org/bennieston-tutorial/
http://nmap.org/bennieston-tutorial/
Contents
1 Introduction
Nmap is a free, open-source port scanner available for both UNIX and Windows. It has an optional graphical front-end, NmapFE, and supports a wide variety of scan types, each one with different benefits and drawbacks.
This article describes some of these scan types, explaining their relative benefits and just how they actually work. It also offers tips about which types of scan would be best against which types of host.
The article assumes you have Nmap installed (or that you know how to install it. Instructions are available on the Nmap website, http://www.insecure.org/nmap/install/inst-source.html ), and that you have the required privileges to run the scans detailed (many scans require root or Administrator privileges).
A frequently asked questions section has been added since the first version of this article, and this is included as the last section in this version. This is a fully revised and updated version of this tutorial, re-typed and converted to a TeX format, allowing more output formats to be utilised. At the time of writing, the latest Nmap version was 4.11.
2 Disclaimer
This information is provided to assist users of Nmap in scanning their own networks, or networks for which they have been given permission to scan, in order to determine the security of such networks. it is not intended to assist with scanning remote sites with the intention of breaking into or exploiting services on those sites, or for imformation gathering purposes beyond those allowed by law. I hereby disclaim any responsibility for actions taken based upon the information in this article, and urge all who seek information towards a destructive end to reconsider their life, and do something constructive instead.
3 Basic Scan Types [-sT, -sS]
The two basic scan types used most in Nmap are TCP connect() scanning [-sT] and SYN scanning (also known as half-open, or stealth scanning) [-sS].
These two types are explained in detail below.
3.1 TCP connect() Scan [-sT]
These scans are so called because UNIX sockets programming uses a system call named connect() to begin a TCP connection to a remote site. If connect() succeeds, a connection was made. If it fails, the connection could not be made (the remote system is offline, the port is closed, or some other error occurred along the way). This allows a basic type of port scan, which attempts to connect to every port in turn, and notes whether or not the connection succeeded. Once the scan is completed, ports to which a connection could be established are listed as open, the rest are said to be closed.
This method of scanning is very effective, and provides a clear picture of the ports you can and cannot access. If a connect() scan lists a port as open, you can definitely connect to it - that is what the scanning computer just did! There is, however, a major drawback to this kind of scan; it is very easy to detect on the system being scanned. If a firewall or intrusion detection system is running on the victim, attempts to connect() to every port on the system will almost always trigger a warning. Indeed, with modern firewalls, an attempt to connect to a single port which has been blocked or has not been specifically "opened" will usually result in the connection attempt being logged. Additionally, most servers will log connections and their source IP, so it would be easy to detect the source of a TCP connect() scan.
For this reason, the TCP Stealth Scan was developed.
3.2 SYN Stealth Scan [-sS]
I’ll begin this section with an overview of the TCP connection process. Those familiar with TCP/IP can skip the first few paragraphs.
When a TCP connection is made between two systems, a process known as a "three way handshake" occurs. This involves the exchange of three packets, and synchronises the systems with each other (necessary for the error correction built into TCP. Refer to a good TCP/IP book for more details.
The system initiating the connection sends a packet to the system it wants to connect to. TCP packets have a header section with a flags field. Flags tell the receiving end something about the type of packet, and thus what the correct response is.
Here, I will talk about only four of the possible flags. These are SYN (Synchronise), ACK (Acknowledge), FIN (Finished) and RST (Reset). SYN packets include a TCP sequence number, which lets the remote system know what sequence numbers to expect in subsequent communication. ACK acknowledges receipt of a packet or set of packets, FIN is sent when a communication is finished, requesting that the connection be closed, and RST is sent when the connection is to be reset (closed immediately).
To initiate a TCP connection, the initiating system sends a SYN packet to the destination, which will respond with a SYN of its own, and an ACK, acknowledging the receipt of the first packet (these are combined into a single SYN/ACK packet). The first system then sends an ACK packet to acknowledge receipt of the SYN/ACK, and data transfer can then begin.
SYN or Stealth scanning makes use of this procedure by sending a SYN packet and looking at the response. If SYN/ACK is sent back, the port is open and the remote end is trying to open a TCP connection. The scanner then sends an RST to tear down the connection before it can be established fully; often preventing the connection attempt appearing in application logs. If the port is closed, an RST will be sent. If it is filtered, the SYN packet will have been dropped and no response will be sent. In this way, Nmap can detect three port states - open, closed and filtered. Filtered ports may require further probing since they could be subject to firewall rules which render them open to some IPs or conditions, and closed to others.
Modern firewalls and Intrusion Detection Systems can detect SYN scans, but in combination with other features of Nmap, it is possible to create a virtually undetectable SYN scan by altering timing and other options (explained later).
4 FIN, Null and Xmas Tree Scans [-sF, -sN, -sX]
With the multitude of modern firewalls and IDS’ now looking out for SYN scans, these three scan types may be useful to varying degrees. Each scan type refers to the flags set in the TCP header. The idea behind these type of scans is that a closed port should respond with an RST upon receiving packets, whereas an open port should just drop them (it’s listening for packets with SYN set). This way, you never make even part of a connection, and never send a SYN packet; which is what most IDS’ look out for.
The FIN scan sends a packet with only the FIN flag set, the Xmas Tree scan sets the FIN, URG and PUSH flags (see a good TCP/IP book for more details) and the Null scan sends a packet with no flags switched on.
These scan types will work against any system where the TCP/IP implementation follows RFC 793. Microsoft Windows does not follow the RFC, and will ignore these packets even on closed ports. This technicality allows you to detect an MS Windows system by running SYN along with one of these scans. If the SYN scan shows open ports, and the FIN/NUL/XMAS does not, chances are you’re looking at a Windows box (though OS Fingerprinting is a much more reliable way of determining the OS running on a target!)
The sample below shows a SYN scan and a FIN scan, performed against a Linux system. The results are, predictably, the same, but the FIN scan is less likely to show up in a logging system.
1 [chaos]# nmap -sS 127.0.0.1
2
3 Starting Nmap 4.01 at 2006-07-06 17:23 BST
4 Interesting ports on chaos (127.0.0.1):
5 (The 1668 ports scanned but not shown below are in state:
6 closed)
7 PORT STATE SERVICE
8 21/tcp open ftp
9 22/tcp open ssh
10 631/tcp open ipp
11 6000/tcp open X11
12
13 Nmap finished: 1 IP address (1 host up) scanned in 0.207
14 seconds
15 [chaos]# nmap -sF 127.0.0.1
16
17 Starting Nmap 4.01 at 2006-07-06 17:23 BST
18 Interesting ports on chaos (127.0.0.1):
19 (The 1668 ports scanned but not shown below are in state:
20 closed)
21 PORT STATE SERVICE
22 21/tcp open|filtered ftp
23 22/tcp open|filtered ssh
24 631/tcp open|filtered ipp
25 6000/tcp open|filtered X11
26
27 Nmap finished: 1 IP address (1 host up) scanned in 1.284
28 seconds
5 Ping Scan [-sP]
This scan type lists the hosts within the specified range that responded to a ping. It allows you to detect which computers are online, rather than which ports are open. Four methods exist within Nmap for ping sweeping.
The first method sends an ICMP ECHO REQUEST (ping request) packet to the destination system. If an ICMP ECHO REPLY is received, the system is up, and ICMP packets are not blocked. If there is no response to the ICMP ping, Nmap will try a "TCP Ping", to determine whether ICMP is blocked, or if the host is really not online.
A TCP Ping sends either a SYN or an ACK packet to any port (80 is the default) on the remote system. If RST, or a SYN/ACK, is returned, then the remote system is online. If the remote system does not respond, either it is offline, or the chosen port is filtered, and thus not responding to anything.
When you run an Nmap ping scan as root, the default is to use the ICMP and ACK methods. Non-root users will use the connect() method, which attempts to connect to a machine, waiting for a response, and tearing down the connection as soon as it has been established (similar to the SYN/ACK method for root users, but this one establishes a full TCP connection!)
The ICMP scan type can be disabled by setting -P0 (that is, zero, not uppercase o).
6 UDP Scan [-sU]
Scanning for open UDP ports is done with the -sU option. With this scan type, Nmap sends 0-byte UDP packets to each target port on the victim. Receipt of an ICMP Port Unreachable message signifies the port is closed, otherwise it is assumed open.
One major problem with this technique is that, when a firewall blocks outgoing ICMP Port Unreachable messages, the port will appear open. These false-positives are hard to distinguish from real open ports.
Another disadvantage with UDP scanning is the speed at which it can be performed. Most operating systems limit the number of ICMP Port Unreachable messages which can be generated in a certain time period, thus slowing the speed of a UDP scan. Nmap adjusts its scan speed accordingly to avoid flooding a network with useless packets. An interesting point to note here is that Microsoft do not limit the Port Unreachable error generation frequency, and thus it is easy to scan a Windows machine’s 65,535 UDP Ports in very little time!!
UDP Scanning is not usually useful for most types of attack, but it can reveal information about services or trojans which rely on UDP, for example SNMP, NFS, the Back Orifice trojan backdoor and many other exploitable services.
Most modern services utilise TCP, and thus UDP scanning is not usually included in a pre-attack information gathering exercise unless a TCP scan or other sources indicate that it would be worth the time taken to perform a UDP scan.
7 IP Protocol Scans [-sO]
The IP Protocol Scans attempt to determine the IP protocols supported on a target. Nmap sends a raw IP packet without any additional protocol header (see a good TCP/IP book for information about IP packets), to each protocol on the target machine. Receipt of an ICMP Protocol Unreachable message tells us the protocol is not in use, otherwise it is assumed open. Not all hosts send ICMP Protocol Unreachable messages. These may include firewalls, AIX, HP-UX and Digital UNIX). These machines will report all protocols open.
This scan type also falls victim to the ICMP limiting rate described in the UDP scans section, however since only 256 protocols are possible (8-bit field for IP protocol in the IP header) it should not take too long.
Results of an -sO on my Linux workstation are included below.
1 [chaos]# nmap -sO 127.0.0.1
2
3 Starting Nmap 4.01 at 2006-07-14 12:56 BST
4 Interesting protocols on chaos(127.0.0.1):
5 (The 251 protocols scanned but not shown below are
6 in state: closed)
7 PROTOCOL STATE SERVICE
8 1 open icmp
9 2 open|filtered igmp
10 6 open tcp
11 17 open udp
12 255 open|filtered unknown
13
14 Nmap finished: 1 IP address (1 host up) scanned in
15 1.259 seconds
8 Idle Scanning [-sI]
Idle scanning is an advanced, highly stealthed technique, where no packets are sent to the target which can be identified to originate from the scanning machine. A zombie host (and optionally port) must be specified for this scan type. The zombie host must satisfy certain criteria essential to the workings of this scan.
This scan type works by exploiting "predictable IP fragmentation ID" sequence generation on the zombie host, to determine open ports on the target. The scan checks the IPID on the zombie, then spoofs a connection request to the target machine, making it appear to come from the zombie. If the target port is open, a SYN/ACK session acknowledgement will be sent from the target machine back to the zombie, which will RST the connection since it has no record of having opened such a connection. If the port on the target is closed, an RST will be sent to the zombie, and no further packets will be sent. The attacker then checks the IPID on the zombie again. If it has incremented by 2 (or changed by two steps in its sequence), this corresponds to the packet received from the target, plus the RST from the zombie, which equates to an open port on the target. If the IPID has changed by one step, an RST was received from the target and no further packets were sent.
Using this mechanism, it is possible to scan every port on a target, whilst making it appear that the zombie was the one doing the scanning. Of course, the spoofed connection attempts will likely be logged, so the target system will have the zombie IP address, and the zombie system’s logs are likely to contain the attacker’s IP address, so it is still possible, after acquiring logs through legal channels, to determine the attacker, but this method makes it much more difficult to do so than if the packets were sent directly from the attacker. In addition, some IDS and firewall software makes attempts to detect spoofed packets based on the network they arrive from. As long as the zombie host and the attacker are both "out on the Internet", or on the same network as each other, relative to the target, techniques to identify spoofed packets are not likely to succeed.
This scan type requires certain things of the zombie. The IPID sequence generation must be predictable (single-step increments, for example). The host must also have low traffic so that it is unlikely for other packets to hit the zombie whilst Nmap is carrying out its scan (as these will artificially inflate the IPID number!). Cheap routers or MS Windows boxes make good zombie hosts. Most operating systems use randomised sequence numbers (see the OS Fingerprinting section for details on how to check a target’s sequence generation type).
The idle scan can also be used to determine IP trust based relationships between hosts (e.g. a firewall may allow a certain host to connect to port x, but not other hosts). This scan type can help to determine which hosts have access to such a system.
For more information about this scan type, read http://www.insecure.org/nmap/idlescan.html
9 Version Detection [-sV]
Version Detection collects information about the specific service running on an open port, including the product name and version number. This information can be critical in determining an entry point for an attack. The -sV option enables version detection, and the -A option enables both OS fingerprinting and version detection, as well as any other advanced features which may be added in future releases.
Version detection is based on a complex series of probes, detailed in the Version Detection paper at http://www.insecure.org/nmap/vscan/
10 ACK Scan [-sA]
Usually used to map firewall rulesets and distinguish between stateful and stateless firewalls, this scan type sends ACK packets to a host. If an RST comes back, the port is classified "unfiltered" (that is, it was allowed to send its RST through whatever firewall was in place). If nothing comes back, the port is said to be "filtered". That is, the firewall prevented the RST coming back from the port. This scan type can help determine if a firewall is stateless (just blocks incoming SYN packets) or stateful (tracks connections and also blocks unsolicited ACK packets).
Note that an ACK scan will never show ports in the "open" state, and so it should be used in conjunction with another scan type to gain more information about firewalls or packet filters between yourself and the victim.
11 Window Scan, RPC Scan, List Scan [-sW, -sR, -sL]
The TCP Window scan is similar to the ACK scan but can sometimes detect open ports as well as filtered/unfiltered ports. This is due to anomalies in TCP Window size reporting by some operating systems (see the Nmap manual for a list, or the nmap-hackers mailing list for the full list of susceptible OS’).
RPC Scans can be used in conjunction with other scan types to try to determine if an open TCP or UDP port is an RPC service, and if so, which program, and version numbers are running on it. Decoys are not supported with RPC scans (see section on Timing and Hiding Scans, below).
List scanning simply prints a list of IPs and names (DNS resolution will be used unless the -n option is passed to Nmap) without actually pinging or scanning the hosts.
12 Timing and Hiding Scans
12.1 Timing
Nmap adjusts its timings automatically depending on network speed and response times of the victim. However, you may want more control over the timing in order to create a more stealthy scan, or to get the scan over and done with quicker.
The main timing option is set through the -T parameter. There are six predefined timing policies which can be specified by name or number (starting with 0, corresponding to Paranoid timing). The timings are Paranoid, Sneaky, Polite, Normal, Aggressive and Insane.
A -T Paranoid (or -T0) scan will wait (generally) at least 5 minutes between each packet sent. This makes it almost impossible for a firewall to detect a port scan in progress (since the scan takes so long it would most likely be attributed to random network traffic). Such a scan will still show up in logs, but it will be so spread out that most analysis tools or humans will miss it completely.
A -T Insane (or -T5) scan will map a host in very little time, provided you are on a very fast network or don’t mind losing some information along the way.
Timings for individual aspects of a scan can also be set using the –host_timeout, –max_rtt_timeout, –min_rtt_timeout, –initial_rtt_timeout, –max_parallelism, –min_parallelism, and –scan_delay options. See the Nmap manual for details.
12.2 Decoys
The -D option allows you to specify Decoys. This option makes it look like those decoys are scanning the target network. It does not hide your own IP, but it makes your IP one of a torrent of others supposedly scanning the victim at the same time. This not only makes the scan look more scary, but reduces the chance of you being traced from your scan (difficult to tell which system is the "real" source).
12.3 FTP Bounce
The FTP protocol (RFC 959) specified support for a "proxy" ftp, which allowed a connection to an FTP server to send data to anywhere on the internet. This tends not to work with modern ftpds, in which it is an option usually disabled in the configuration. If a server with this feature is used by Nmap, it can be used to try to connect to ports on your victim, thus determining their state.
This scan method allows for some degree of anonymity, although the FTP server may log connections and commands sent to it.
12.4 Turning Off Ping
The -P0 (that’s a zero) option allows you to switch off ICMP pings. The -PT option switches on TCP Pings, you can specify a port after the -PT option to be the port to use for the TCP ping.
Disabling pings has two advantages: First, it adds extra stealth if you’re running one of the more stealthy attacks, and secondly it allows Nmap to scan hosts which don’t reply to pings (ordinarily, Nmap would report those hosts as being "down" and not scan them).
In conjunction with -PT, you can use -PS to send SYN packets instead of ACK packets for your TCP Ping.
The -PU option (with optional port list after) sends UDP packets for your "ping". This may be best to send to suspected-closed ports rather than open ones, since open UDP ports tend not to respond to zero-length UDP packets.
Other ping types are -PE (Standard ICMP Echo Request), -PP (ICMP Timestamp Request), -PM (Netmask Request) and -PB (default, uses both ICMP Echo Request and TCP ping, with ACK packets)
12.5 Fragmenting
The -f option splits the IP packet into tiny fragments when used with -sS, -sF, -sX or -sN. This makes it more difficult for a firewall or packet filter to determine the packet type. Note that many modern packet filters and firewalls (including iptables) feature optional defragmenters for such fragmented packets, and will thus reassemble the packet to check its type before sending it on. Less complex firewalls will not be able to cope with fragmented packets this small and will most likely let the OS reassemble them and send them to the port they were intended to reach. Using this option could crash some less stable software and hardware since packet sizes get pretty small with this option!
12.6 Idle Scanning
See the section on -sI for information about idle scans.
13 OS Fingerprinting
The -O option turns on Nmap’s OS fingerprinting system. Used alongside the -v verbosity options, you can gain information about the remote operating system and about its TCP Sequenmce Number generation (useful for planning Idle scans).
An article on OS detection is available at http://www.insecure.org/nmap/nmap-fingerprinting-article.html
14 Outputting Logs
Logging in Nmap can be provided by the -oN, -oX or -oG options. Each one is followed by the name of the logfile. -oN outputs a human readable log, -oX outputs an XML log and -oG outputs a grepable log. The -oA option outputs in all 3 formats, and -oS outputs in a format I’m sure none of you would ever want to use (try it; you’ll see what I mean!)
The –append-output option appends scan results to the output files you specified instead of overwriting their contents.
15 Other Nmap Options
15.1 IPv6
The -6 option enables IPv6 in Nmap (provided your OS has IPv6 support). Currently only TCP connect, and TCP connect ping scan are supported. For other scantypes, see http://nmap6.sourceforge.net
15.2 Verbose Mode
Highly recommended, -v
Use -v twice for more verbosity. The option -d can also be used (once or twice) to generate more verbose output.
15.3 Resuming
Scans cancelled with Ctrl+C can be resumed with the --resume
15.4 Reading Targets From A File
-iL
The file should contain a hostlist or list of network expressions separated by spaces, tabs or newlines. Using a hyphen as inputfile makes Nmap read from standard input.
15.5 Fast Scan
The -F option scans only those ports listed in the nmap_services file (or the protocols file if the scan type is -sO). This is far faster than scanning all 65,535 ports!!
15.6 Time-To-Live
The -ttl
16 Typical Scanning Session
First, we’ll sweep the network with a simple Ping scan to determine which hosts are online.
1 [chaos]# nmap -sP 10.0.0.0/24
2
3 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at
4 2006-07-14 14:19 BST
5 Host 10.0.0.1 appears to be up.
6 MAC Address: 00:09:5B:29:FD:96 (Netgear)
7 Host 10.0.0.2 appears to be up.
8 MAC Address: 00:0F:B5:96:38:5D (Netgear)
9 Host 10.0.0.4 appears to be up.
10 Host 10.0.0.5 appears to be up.
11 MAC Address: 00:14:2A:B1:1E:2E (Elitegroup Computer System Co.)
12 Nmap finished: 256 IP addresses (4 hosts up) scanned in 5.399 seconds
Now we’re going to take a look at 10.0.0.1 and 10.0.0.2, both listed as Netgear in the ping sweep. These IPs are good criteria for routers (in fact I know that 10.0.0.1 is a router and 10.0.0.2 is a wireless access point, since it’s my network, but lets see what Nmap makes of it...)
We’ll scan 10.0.0.1 using a SYN scan [-sS] and -A to enable OS fingerprinting and version detection.
1 [chaos]# nmap -sS -A 10.0.0.1
2
3 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at
4 2006-07-14 14:23 BST
5 Insufficient responses for TCP sequencing (0),
6 OS detection may be less accurate
7 Interesting ports on 10.0.0.1:
8 (The 1671 ports scanned but not shown below are in state:
9 closed)
10 PORT STATE SERVICE VERSION
11 80/tcp open tcpwrapped
12 MAC Address: 00:09:5B:29:FD:96 (Netgear)
13 Device type: WAP
14 Running: Compaq embedded, Netgear embedded
15 OS details: WAP: Compaq iPAQ Connection Point or
16 Netgear MR814
17
18 Nmap finished: 1 IP address (1 host up) scanned in
19 3.533 seconds
The only open port is 80/tcp - in this case, the web admin interface for the router. OS fingerprinting guessed it was a Netgear Wireless Access Point - in fact this is a Netgear (wired) ADSL router. As it said, though, there were insufficient responses for TCP sequencing to accurately detect the OS.
Now we’ll do the same for 10.0.0.2...
1 [chaos]# nmap -sS -A 10.0.0.2
2
3 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ )
4 at 2006-07-14 14:26 BST
5 Interesting ports on 10.0.0.2:
6 (The 1671 ports scanned but not shown below are in state:
7 closed)
8 PORT STATE SERVICE VERSION
9 80/tcp open http Boa HTTPd 0.94.11
10 MAC Address: 00:0F:B5:96:38:5D (Netgear)
11 Device type: general purpose
12 Running: Linux 2.4.X|2.5.X
13 OS details: Linux 2.4.0 - 2.5.20
14 Uptime 14.141 days (since Fri Jun 30 11:03:05 2006)
15
16 Nmap finished: 1 IP address (1 host up) scanned in 9.636
17 seconds
Interestingly, the OS detection here listed Linux, and the version detection was able to detect the httpd running. The accuracy of this is uncertain, this is a Netgear home wireless access point, so it could be running some embedded Linux!
Now we’ll move on to 10.0.0.4 and 10.0.0.5, these are likely to be normal computers running on the network...
1 [chaos]# nmap -sS -P0 -A -v 10.0.0.4
2
3 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at
4 2006-07-14 14:31 BST
5 DNS resolution of 1 IPs took 0.10s. Mode:
6 Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
7 Initiating SYN Stealth Scan against 10.0.0.4 [1672 ports] at 14:31
8 Discovered open port 21/tcp on 10.0.0.4
9 Discovered open port 22/tcp on 10.0.0.4
10 Discovered open port 631/tcp on 10.0.0.4
11 Discovered open port 6000/tcp on 10.0.0.4
12 The SYN Stealth Scan took 0.16s to scan 1672 total ports.
13 Initiating service scan against 4 services on 10.0.0.4 at 14:31
14 The service scan took 6.01s to scan 4 services on 1 host.
15 For OSScan assuming port 21 is open, 1 is closed, and neither are
16 firewalled
17 Host 10.0.0.4 appears to be up ... good.
18 Interesting ports on 10.0.0.4:
19 (The 1668 ports scanned but not shown below are in state: closed)
20 PORT STATE SERVICE VERSION
21 21/tcp open ftp vsftpd 2.0.3
22 22/tcp open ssh OpenSSH 4.2 (protocol 1.99)
23 631/tcp open ipp CUPS 1.1
24 6000/tcp open X11 (access denied)
25 Device type: general purpose
26 Running: Linux 2.4.X|2.5.X|2.6.X
27 OS details: Linux 2.4.0 - 2.5.20, Linux 2.5.25 - 2.6.8 or
28 Gentoo 1.2 Linux 2.4.19 rc1-rc7
29 TCP Sequence Prediction: Class=random positive increments
30 Difficulty=4732564 (Good luck!)
31 IPID Sequence Generation: All zeros
32 Service Info: OS: Unix
33
34 Nmap finished: 1 IP address (1 host up) scanned in 8.333 seconds
35 Raw packets sent: 1687 (74.7KB) | Rcvd: 3382 (143KB)
From this, we can deduce that 10.0.0.4 is a Linux system (in fact, the one I’m typing this tutorial on!) running a 2.4 to 2.6 kernel (Actually, Slackware Linux 10.2 on a 2.6.19.9 kernel) with open ports 21/tcp, 22/tcp, 631/tcp and 6000/tcp. All but 6000 have version information listed. The scan found the IPID sequence to be all zeros, which makes it useless for idle scanning, and the TCP Sequence prediction as random positive integers. The -v option is needed to get Nmap to print the IPID information out!
Now, onto 10.0.0.5...
1 [chaos]# nmap -sS -P0 -A -v 10.0.0.5
2
3 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ )
4 at 2006-07-14 14:35 BST
5 Initiating ARP Ping Scan against 10.0.0.5 [1 port] at 14:35
6 The ARP Ping Scan took 0.01s to scan 1 total hosts.
7 DNS resolution of 1 IPs took 0.02s. Mode: Async
8 [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
9 Initiating SYN Stealth Scan against 10.0.0.5 [1672 ports] at 14:35
10 The SYN Stealth Scan took 35.72s to scan 1672 total ports.
11 Warning: OS detection will be MUCH less reliable because we did
12 not find at least 1 open and 1 closed TCP port
13 Host 10.0.0.5 appears to be up ... good.
14 All 1672 scanned ports on 10.0.0.5 are: filtered
15 MAC Address: 00:14:2A:B1:1E:2E (Elitegroup Computer System Co.)
16 Too many fingerprints match this host to give specific OS details
17 TCP/IP fingerprint:
18 SInfo(V=4.01%P=i686-pc-linux-gnu%D=7/14%Tm=44B79DC6%O=-1%C=-1%M=00142A)
19 T5(Resp=N)
20 T6(Resp=N)
21 T7(Resp=N)
22 PU(Resp=N)
23
24 Nmap finished: 1 IP address (1 host up) scanned in 43.855 seconds
25 Raw packets sent: 3369 (150KB) | Rcvd: 1 (42B)
No open ports, and Nmap couldn’t detect the OS. This suggests that it is a firewalled or otherwise protected system, with no services running (and yet it responded to ping sweeps).
We now have rather more information about this network than we did when we started, and can guess at several other things based on these results. Using that information, and the more advanced Nmap scans, we can obtain further scan results which will help to plan an attack, or to fix weaknesses, in this network.
17 Frequently Asked Questions
This section was added as an extra to the original tutorial as it became popular and some questions were asked about particular aspects of an nmap scan. I’ll use this part of the tutorial to merge some of those into the main tutorial itself.
17.1 I tried a scan and it appeared in firewall logs or alerts. What else can I do to help hide my scan?
This question assumes you used a scan command along the lines of:
1 nmap -sS -P0 -p 1-140 -O -D xxx.xxx.xxx.xxx,
2 xxx.xxx.xxx.xxx, xxx.xxx.xxx.xxx -sV xxx.xx.xxx.xxx
Note: Each xxx corresponds to an octet of the IP address/addresses. This is instructing NMAP to run a Stealth scan (-sS) without pinging (-P0) on ports 1 to 140 (-p 1-140), to use OS Detection (-O) and to use Decoys (-D). The three comma-separated IPs are the decoy IPs to use. It also specifies to use version scanning (-sV) which attempts to determine precisely which program is running on a port.
Now, heres the analysis of this command: A stealth scan (-sS) is often picked up by most firewalls and IDS systems nowdays. It was originally designed to prevent logging of a scan in the logs for whatever server is running on the port the scanner connects to. In other words, if the scan connects to port 80 to test if its open, Apache (or whatever other webserver they may be using) will log the connection in its logfiles.
The -sS scan option doesn’t make a full TCP connect (which can be achieved with the -sT option, or by not running as root) but resets the connection before it can be fully established. As such, most servers will not log the connection, but an IDS or firewall will recognise this behaviour (in repeated cases) as typical of a port scan. This will mean that the scan shows up in firewall or IDS logs and alerts. There are few ways around this, to be honest. Most firewall/IDS software nowdays is quite good at detecting these things; particularly if its running on the same host as the victim (the system you are scanning).
Note also, that decoys will not prevent your IP showing entirely; it just lists the others as well. A particularly well designed IDS may even be able to figure out which is the real source of the scans.
Where speed of scan isn’t essential, the -P0 option is a good idea. Nmap gains timing information from pinging the host, and can often complete its scans faster with this information, but the ping packets will be sent to the victim from your IP, and any IDS worth its CPU cycles will pick up on the pattern of a few pings followed by connects to a variety of ports. -P0 also allows scanning of hosts which do not respond to pings (i.e. if ICMP is blocked by a firewall or by in-kernel settings).
I mentioned timing in the above paragraph. You can use the -T timing option to slow the scan down. The slower a scan is, the less likely it is to be detected by an IDS. There are bound to be occasional random connects occurring, people type an IP in wrong or try to connect and their computer crashes half way through the connect. These things happen, and unless an IDS is configured extremely strictly, they generally aren’t reported (at least, not in the main alert logs, they may be logged if logging of all traffic is enabled, but typically these kind of logs are only checked if theres evidence of something going on). Setting the timing to -T 0 or -T 1 (Paranoid or Sneaky) should help avoid detection. As mentioned in my main tutorial, you can also set timing options for each aspect of a scan,
Timings for individual aspects of a scan can also be set using the –host_timeout, –max_rtt_timeout, –min_rtt_timeout, –initial_rtt_timeout, –max_parallelism, –min_parallelism, and –scan_delay options. See the Nmap manual for details.
The final note I will add to this answer is that use of the Idle scan method (-sI) means that not a single packet is sent to the victim from your IP (provided you also use the -P0 option to turn off pings). This is the ultimate in stealth as there is absolutely no way the victim can determine that your IP is responsible for the scan (short of obtaining log information from the host you used as part of your idle scan).
17.2 NMAP seems to have stopped, or my scan is taking a very long while. Why is this?
The timing options can make it take a very long time. I believe the -T Paranoid ( -T 0 )option waits up to 5 minutes between packets... now, for 65000 ports, thats 65000 x 5 = 325000 minutes = 225 days!!
-T Sneaky ( -T 1 ) waits up to 15 seconds between scans, and is therefore more useful; but scans will still take a long while! You can use -v to get more verbose output, which will alert you as to the progress of the scan. Using -v twice makes the output even more verbose.
17.3 Will -sN -sX and -sF work against any host, or just Windows hosts?
-sN -sX and -sF scans will work against any host, but Windows computers do not respond correctly to them, so scanning a Windows machine with these scans results in all ports appearing closed. Scanning a *nix or other system should work just fine, though. As I said in the main tutorial, -sX -sF and -sN are commonly used to determine if you’re scanning a Windows host or not, without using the -O fingerprinting option.
The Nmap manual page should help to determine which scans work alongside which options, and on which target systems they are most effective.
17.4 How do I find a dummy host for the Idle Scan (-sI)?
You simply have to scan for hosts using sequential IPID sequences, these are (often) suitable for use as a dummy host for the -sI Idle Scan.
17.5 What does "Host seems down. If it is really up, but blocking our ping probes, try -P0" mean?
When Nmap starts, it tries to ping the host to check that it is online. Nmap also gains timing information from this ping. If the remote host, or a system on the path between you and the remote host, is blocking pings, this ping will not be replied to, and Nmap will not start scanning. Using the -P0 option, you can turn off ping-on-start and have Nmap try to scan anyway.
17.6 Where can I find NmapFE?
NmapFE is a graphical front-end for Nmap.
NmapFE for UNIX/Linux is included in the Nmap source. NmapFE for OSX is available at http://faktory.org/m/software/nmap/ NmapFE for Windows is under development as part of NmapFE++, a new frontend for Linux, OSX and Windows. Information is available at http://www.insecure.org/nmap/SoC/NmapFE.html
18 About This Document
This document is copyright ©2003-2009, Andrew J. Bennieston. This document is provided in several formats, including LaTeX source, and it may be freely redistributed in any form, providing no changes are made to the content. The latest version can always be found at http://nmap.org/bennieston-tutorial/
20.02 |
Category: |
0
comments
Bagi yang mau Download Modul Network Security klik gambar yaw...
19.14 |
Category: |
0
comments
1. Before we can achieve success, we need to define what success means for us. Success means different things to different people. For some, monetary reward is a measure of success. Yet others have multiple definition of success. In my definition success is a condition where I can achieve my dreams. It’s mean if my dreams come true that’s success for me. In common, success means a condition where there are a lot of amazing thing, gracefully personal (great house, go vacation, traveling, new experience, assurance of money for our family), get respectability, leadership from our business partner. And the main definition of success is freedom (freedom from fear, scare, bedevil and failure).
2. The main key we need to get success is believe and confident that we can achieve success. If we believe “I-Can-Do it” and really believe of it, than “How we do it” will automatic branch out. For example in cyberspace exploration, without strongest belief that human can operate cyberspace exploration, the scientists will not have a braveness or interest to try to investigate of it. belief in a big dream is a activator power, the power behind
3. The second success key is a right action. After we have a clear definition of success and have a strongest belief we can achieve success, we must do the right action to make our dream come true. For example if we want to have a nice car but every day we just watching television, it will not happen. For me, to make my dream come true I will divide my big dream to be something I can do today.
20.28 |
Category: |
0
comments
1. Sebelum kita bisa meraih sebuah kesuksesan kita harus mempunyai definisi yang jelas dari kata sukses .Karena definisi sukses bagi setiap orang berbeda – beda, maka disini saya akan jelaskan definisi sukses menurut saya. sukses adalah keadaan dimana saya bisa meraih apa yang saya mimpikan dalam hidup saya. Dan secara umum arti sukses adalah suatu keadaan dimana banyak hal yang mengagumkan, kesejahteraan pribadi (rumah yang bagus, liburan, perjalanan, pengalaman baru, jaminan keuangan untuk keluarga), memperoleh kehormatan, kepemimpinan, disegani oleh rekan bisnis dan popular di kalangan teman, kebebasan dalam segala hal.
2. Kunci yang paling utama dan mendasar untuk meraih sebuah kesuksesan adalah kita percaya dan yakin bahwa kita bisa meraih kesuksesan tersebut. Jika kita percaya “Saya-dapat-melakukannya” dan benar – benar percaya, maka “bagaimana melakukannya” pun akan berkembang secara otomatis. Sebagai contoh dari pendapat saya ini adalah dalam hal penjelajahan luar angkasa dewasa ini. Tanpa kepercayaan yang kuat dan tidak tergoyahkan bahwa manusia dapat mengadakan perjalanan ke ruang angkasa, para ilmuwan tidak akan mempunyai keberanian, minat, dan antusiasme untuk maju. Kepercayaan akan hasil yang besar adalah kekuatan penggerak, daya di belakang semua buku besar, drama besar, penemuan ilmiah yang besar.
3. Kunci success yang kedua adalah aksi yang tepat. Setelah kita mempunyai arti yang jelas tentang kata success untuk diri kita dan percaya kita bisa meraihnya maka kita harus melakukan tindakan yang tepat untuk mewujudkan semua impian(kesuksesan) kita. Sebagai contoh jika kita mempunyai impian untuk mempunyai rumah mewah, mobil mewah namun kita tidak akan pernah mendapatkannya jika setiap hari kita hanya menonton televise atau melakukan hal – hal yang tidak berhubungan dengan impian kita tersebut. Sedangkan bagi saya agar saya bisa meraih sebuah impian saya akan membagai impian besar saya tersebut sampai menjadi hal – hal yang bisa saya kerjakan hari ini.
20.08 |
Category: |
0
comments
bagi temen - temen yang mau download modul nya iBu ari jayanti..klik link dibawah ni yaw....
Modul RPL 2
Modul RPL 2
08.03 |
Category: |
0
comments
wah..sudah lama rasanya saya tidak pernah lagi membuat postingan di blog ini. maklum di kampus lagi banyak libur, ha ha ha... makanya jadi keasikan liburan dah.. yah sekarang uda mulai lagi menempuh perkuliahan yang bener2 bikin pusing kepala, tapi bagaimana pun ya harus dijalani.. he he... ya uda deh.. sekarang mau aktif lagi posting - posting artikel.. kata pepatah sih ilmu bisa diikat dengan cara ditulis, mau nyoba dah... Here I Come my Blog...
07.56 |
Category: |
0
comments
Copy - paste dari http://kb.linuxhelp.web.id/index.php?action=artikel&cat=1&id=115&artlang=en
Semoga bermanfaat...
Axioo yang merupakan salah satu vendor notebook yang paling banyak diminati didalam negeri karena mempunyai harga yang bisa dijangkau oleh pangsa pasar dalam negeri. Untuk instalasi under linux axioo menyediakan linux mandiva sebagai default distribusi linuxnya dan biasanya linux mandriva yang diberikan telah di remaster atau diubah sesuai dengan kebutuhan notebook / laptop.
Banyak pengguna linux mengalami masalah ketika melakukan instalasi menggunakan Axioo, dari masalah grafis, sound, dll. Instalasi ubuntu 8.10 saat ini menggunakan Axioo TVR152C dan setelah diinstall dengan cara normal, grafis tidak bisa digunakan dengan kata lain layar putih / white screen.
Sekarang saatnya untuk membuat sedikit tips untuk menginstal ubuntu 8.10 pada laptop Axioo TVR152C. Komponen yang harus disediakan antara lain :
1. Laptop Axioo TVR152C
2. CD / DVD ubuntu 8.10
3. Koneksi internet
4. Flash disk
INSTALASI
1. Masukkan CD / DVD ubuntu kedalam Cd drive Axioo, jangan lupa pilih CDROM sebagai first boot pada boot sequence.
Setelah pemilihan bahasa adalah saatnya melakukan instalasi, tetapi instalasi yang digunakan bukan instalasi normal melainkan dengan menggunakan save graphical mode. Caranya yaitu pilih Install ubuntu kemudian tekan F4 - pilih save graphical mode - [ Enter ], tekan kembali Esc - [ Enter ]
2. Ikuti instruksi instalasi dengan baik dan instalasi akan berjalan dengan lancar.
Sebagai catatan, ketika selesai instalasi dan sistem akan reboot layar akan berubah menjadi putih sedikit-demi sedikit. Hal ini dikarenakan VGA belum terkonfigurasi dengan baik, restart saja laptop secara manual dengan tombol on / off.
KONFIGURASI
Saat ini akan dilakukan konfigurasi pada VGA yang dimiliki oleh Axioo TVR 152C yaitu VIA chrome9 IP HC yang memang sangat bermasalah dengan distribusi Ubuntu pada umumnya. Setelah dicari tahu didalam sistem dengan menggunakan dmesg ternyata sebenarnya VGA sudah dikenali dengan baik dan berarti tidak usah mengisntal driver VGA lagi.
Setelah instalasi Anda tidak akan dapat menggunakan mode grafis karena resolusi yang digunakan belum sesuai, ini dikarenakan VGA yang digunakan masih menggunakan vesa. Sekarang kita akan mencoba melakukan konfigurasi VGA untuk mengatasi masalah tersebut. Langkah – langkahnya antara lain :
1. Download skript openchrome-stable(8.10).sh dari http://www.linuxhelp.web.id/software/openchrome-stable(8.10).sh dan kemudian masukkan ke flash disk.
Restart komputer dan tekan Esc pada menu GRUB. Pilih Recovery mode
Pada recovery mode pilih masuk kedalam konsol root.
Masukkan flash disk, kemudian mounting flash disk.
# mount /dev/sdb1 /mnt
# cd /mnt
2. Jalankan skrip openchrome-stable(8.10).sh (harus terhubung dengan internet)
# chmod 777 openchrome-stable(8.10).sh
# ./openchrome-stable(8.10).sh
3. Ikuti proses yang sedang berlanjut, Ketik Y atau y kemudian [ENTER] ketika diminta untuk melakukan beberapa konfirmasi.
Setelah proses selesai maka xorg.conf hasil proses yang baru sudah terdapat pada direktori /etx/X11. Edit file xorg.conf teresebut dengan menambahkan baris berikut ini pada bagian atas Section device.
Section "Module"
Disable "dri"
EndSection
Restart Komputer Anda dan Ubuntu 8.10 siap untuk digunakan pada laptop Axioo TVR152C
Semoga bermanfaat...
Axioo yang merupakan salah satu vendor notebook yang paling banyak diminati didalam negeri karena mempunyai harga yang bisa dijangkau oleh pangsa pasar dalam negeri. Untuk instalasi under linux axioo menyediakan linux mandiva sebagai default distribusi linuxnya dan biasanya linux mandriva yang diberikan telah di remaster atau diubah sesuai dengan kebutuhan notebook / laptop.
Banyak pengguna linux mengalami masalah ketika melakukan instalasi menggunakan Axioo, dari masalah grafis, sound, dll. Instalasi ubuntu 8.10 saat ini menggunakan Axioo TVR152C dan setelah diinstall dengan cara normal, grafis tidak bisa digunakan dengan kata lain layar putih / white screen.
Sekarang saatnya untuk membuat sedikit tips untuk menginstal ubuntu 8.10 pada laptop Axioo TVR152C. Komponen yang harus disediakan antara lain :
1. Laptop Axioo TVR152C
2. CD / DVD ubuntu 8.10
3. Koneksi internet
4. Flash disk
INSTALASI
1. Masukkan CD / DVD ubuntu kedalam Cd drive Axioo, jangan lupa pilih CDROM sebagai first boot pada boot sequence.
Setelah pemilihan bahasa adalah saatnya melakukan instalasi, tetapi instalasi yang digunakan bukan instalasi normal melainkan dengan menggunakan save graphical mode. Caranya yaitu pilih Install ubuntu kemudian tekan F4 - pilih save graphical mode - [ Enter ], tekan kembali Esc - [ Enter ]
2. Ikuti instruksi instalasi dengan baik dan instalasi akan berjalan dengan lancar.
Sebagai catatan, ketika selesai instalasi dan sistem akan reboot layar akan berubah menjadi putih sedikit-demi sedikit. Hal ini dikarenakan VGA belum terkonfigurasi dengan baik, restart saja laptop secara manual dengan tombol on / off.
KONFIGURASI
Saat ini akan dilakukan konfigurasi pada VGA yang dimiliki oleh Axioo TVR 152C yaitu VIA chrome9 IP HC yang memang sangat bermasalah dengan distribusi Ubuntu pada umumnya. Setelah dicari tahu didalam sistem dengan menggunakan dmesg ternyata sebenarnya VGA sudah dikenali dengan baik dan berarti tidak usah mengisntal driver VGA lagi.
Setelah instalasi Anda tidak akan dapat menggunakan mode grafis karena resolusi yang digunakan belum sesuai, ini dikarenakan VGA yang digunakan masih menggunakan vesa. Sekarang kita akan mencoba melakukan konfigurasi VGA untuk mengatasi masalah tersebut. Langkah – langkahnya antara lain :
1. Download skript openchrome-stable(8.10).sh dari http://www.linuxhelp.web.id/software/openchrome-stable(8.10).sh dan kemudian masukkan ke flash disk.
Restart komputer dan tekan Esc pada menu GRUB. Pilih Recovery mode
Pada recovery mode pilih masuk kedalam konsol root.
Masukkan flash disk, kemudian mounting flash disk.
# mount /dev/sdb1 /mnt
# cd /mnt
2. Jalankan skrip openchrome-stable(8.10).sh (harus terhubung dengan internet)
# chmod 777 openchrome-stable(8.10).sh
# ./openchrome-stable(8.10).sh
3. Ikuti proses yang sedang berlanjut, Ketik Y atau y kemudian [ENTER] ketika diminta untuk melakukan beberapa konfirmasi.
Setelah proses selesai maka xorg.conf hasil proses yang baru sudah terdapat pada direktori /etx/X11. Edit file xorg.conf teresebut dengan menambahkan baris berikut ini pada bagian atas Section device.
Section "Module"
Disable "dri"
EndSection
Restart Komputer Anda dan Ubuntu 8.10 siap untuk digunakan pada laptop Axioo TVR152C
09.25 |
Category: |
0
comments
Kali ini kita akan membahas sedikit mengenai subnetting. Dengan subnetting, kita dapat menentukan jumlah host yang akan digunakan di dalam jaringan. Apa manfaat menentukan banyaknya host di dalam suatu jaringan? Banyak, salah satunya adalah mengefisiensikan penggunaan resource yang digunakan untuk membroadcast ke jaringan. Bila kita hanya punya 10 host, tapi subnetmask kita tidak kita set untuk hanya 10 host, maka paket data yang masuk ke jaringan akan dibroadcast ke seluruh alamat IP (host), walaupun host itu pada kenyataannya tidak pernah ada. Oleh karena itu, maka kita perlu menggunakan subnetting untuk mengefisiensikan penggunaan bandwitdh jaringan.
Bagaimana cara memecah network menjadi subnetwork? Salah satunya menggunakan subnetmask. Pada artikel ini, kita akan menggunakan IP v4 class C untuk contohnya. Untuk memulai, mari kita buktikan nilai default dari IP Class C. Untuk Class C bila tidak dibuat subnet, maka default subnetmasknya adalah 255.255.255.0 dan jumlah maksimal host/clientnya adalah 254 host. Mari kita buktikan dengan menghitungnya.
Misal sebuah network dengan alamat 192.168.0.0/24. Berapa subnetmasknya? Subnet dapat dilihat dari angka /24 berarti subnetnya adalah 24 bit. Karena alamat IP v.4 merupakan 32 bit dan dibagi menjadi 4 (setiap 8 bit dipisah menggunakan titik), jadi subnetnya adalah 255.255.255.0. Kok bisa? Mari kita sok tahu dikit.
IP = 32 bit = X.X.X.X
Setiap X mewakili 8 bit, bit = binary = nilai 0 atau 1
/24 berarti bit yang bernilai 1 ada 24 buah, ditulis dari kiri ke kanan
/24 = 11111111.11111111.11111111.00000000 = 255.255.255.0
NB: pada kenyataannya, /xx atau disebut prefix tidak pernah dituliskan saat kita mengonfigurasi IP untuk komputer. Karena komputer sudah dapat menentukan prefix secara otomatis menggunakan subnetmask. Misal, kita akan mengeset IP untuk client/host pada network 192.168.0.0/24, maka yang perlu kita lakukan adalah menentukan alamat IP untuk host (192.168.0.1 – 192.168.0.254), subnetmask default (255.255.255.0), dan alamat default gateway serta alamat DNS servernya saja. Kita tidak perlu menuliskan IP 192.168.0.x/24.
Kembali ke pokok bahasan, setelah diketahui subnet masknya, kita dapat menghitung jumlah hostnya dengan cara:
Jumlah Host = 2n – 2
Kenapa dikurangi 2? Karena digunakan untuk alamat network (biasanya host ke-0, untuk contoh ini maka alamat network = 192.168.0.0) dan alamat broadcast (biasanya host terakhir, untuk contoh ini maka alamat broadcast = 192.168.0.255). Berapa nilai n? n = banyaknya angka 0 pada subnetmask (angka 0 dihitung pada nilai binary bukan desimal). Pada contoh di atas, berarti n = 8. Jadi jumlah host adalah 28 – 2 = 256 – 2 = 254 host.
Jadi jaringan dengan subnetmask 255.255.255.0 mempunyai jumlah host sebanyak 254 host. Pada tahap ini, terbukti bahwa IP class C bila tidak disubnet, maka akan mempunyai jumlah host sebanyak 254 host. Lalu bagaimana bila ternyata hanya terdapat 10 host saja? Seperti pernyataan yang terdapat di paragraf pertama, akan terjadi banyak sekali pemborosan. Di sinilah kegunaan subnetting.
Bila kita hanya mempunyai 10 host, maka kita dapat menggunakan subnetmask 255.255.255.240 untuk mengefisiensikan jaringan kita. Bagaimana cara mengetahuinya? Mari kita bersama-sama menghitungnya.
Jumlah Host = 2n – 2
10 <= 2n – 2
n = 4, diperoleh dari 2n – 2 yang mendekati 10
n mewakili host portion pada subnetmask. Karena host portion yang dipakai hanya 4, maka sisanya (4 bit) akan dipakai sebagai subnet portion. Seperti yang telah kita ketahui, n merupakan jumlah angka 0 dari subnetmask, dihitung/ditulis dari kanan. Dengan demikian, subnetmask subnetwork yang baru adalah 255.255.255.11110000 = 255.255.255.240.
NB: subnetmask dibagi menjadi 2 bagian, yaitu subnet portion (diwakili dengan angka 1 pada nilai binary) dan host portion (diwakili dengan angka 0 pada nilai binary). Untuk IP class C, nilai default subnet portionnya adalah 24 bit, dan host portionnya adalah 8 bit.
Dengan subnetmask 255.255.255.240, berapakah jumlah host maksimal dan berapa jumlah subnet yang dapat dibuat? Untuk menghitung jumlah host, digunakan rumus 2n – 2, n kecil mewakili jumlah angka 0 pada host portion. Sedang untuk menghitung jumlah subnet, kita dapat menggunakan rumus 2N – 2 (menurut cisco), N mewakili jumlah angka 1 pada host portion.
NB: untuk mencari jumlah subnet, ada yang menggunakan rumus 2N saja tanpa dikurangi 2. Hanya cisco yang mengurangkan dengan dua, karena secara default router cisco tidak menggunakan subnet ke-0 (kalau gak salah istilahnya “no ip zero subnet”) dan subnet yang terakhir digunakan untuk cadangan. Aku kurang paham tentang masalah ini.
Untuk contoh ini, maka klasifikasi jaringan yang baru adalah
Jumlah host/subnet = 2n – 2 = 24 – 2 = 14 host
Jumlah subnet = 2N – 2 = 24 – 2 = 14 subnet
Setelah kita menggunakan subnetmask 255.255.255.240, maka jaringan kita telah terbagi menjadi 14 subnet dengan jumlah maksimal host per subnet adalah 14 host. Lha kan Cuma ada 10 host doang? Ya gak papalah, memboroskan bandwidth untuk 4 host, masih lebih irit bila dibandingkan dengan 244 host, kan? Betul gak sih?
Klasifikasi jaringan 192.168.0.0/28
Subnet #0 (defaultnya tidak digunakan pada router cisco)
Alamat network = 192.168.0.0/28
Alamat host = 192.168.0.1/28 – 192.168.0.14/28
Alamat broadcast = 192.168.0.15/28
Subnet #1
Alamat network = 192.168.0.16/28
Alamat host = 192.168.0.17/28 – 192.168.0.30/28
Alamat broadcast = 192.168.0.31/28
Dan seterusnya...
NB: prefik /28 diperoleh dari default value (24) ditambah dengan jumlah host portion yang digunakan untuk subnet portion (4).
Bagaimana cara memecah network menjadi subnetwork? Salah satunya menggunakan subnetmask. Pada artikel ini, kita akan menggunakan IP v4 class C untuk contohnya. Untuk memulai, mari kita buktikan nilai default dari IP Class C. Untuk Class C bila tidak dibuat subnet, maka default subnetmasknya adalah 255.255.255.0 dan jumlah maksimal host/clientnya adalah 254 host. Mari kita buktikan dengan menghitungnya.
Misal sebuah network dengan alamat 192.168.0.0/24. Berapa subnetmasknya? Subnet dapat dilihat dari angka /24 berarti subnetnya adalah 24 bit. Karena alamat IP v.4 merupakan 32 bit dan dibagi menjadi 4 (setiap 8 bit dipisah menggunakan titik), jadi subnetnya adalah 255.255.255.0. Kok bisa? Mari kita sok tahu dikit.
IP = 32 bit = X.X.X.X
Setiap X mewakili 8 bit, bit = binary = nilai 0 atau 1
/24 berarti bit yang bernilai 1 ada 24 buah, ditulis dari kiri ke kanan
/24 = 11111111.11111111.11111111.00000000 = 255.255.255.0
NB: pada kenyataannya, /xx atau disebut prefix tidak pernah dituliskan saat kita mengonfigurasi IP untuk komputer. Karena komputer sudah dapat menentukan prefix secara otomatis menggunakan subnetmask. Misal, kita akan mengeset IP untuk client/host pada network 192.168.0.0/24, maka yang perlu kita lakukan adalah menentukan alamat IP untuk host (192.168.0.1 – 192.168.0.254), subnetmask default (255.255.255.0), dan alamat default gateway serta alamat DNS servernya saja. Kita tidak perlu menuliskan IP 192.168.0.x/24.
Kembali ke pokok bahasan, setelah diketahui subnet masknya, kita dapat menghitung jumlah hostnya dengan cara:
Jumlah Host = 2n – 2
Kenapa dikurangi 2? Karena digunakan untuk alamat network (biasanya host ke-0, untuk contoh ini maka alamat network = 192.168.0.0) dan alamat broadcast (biasanya host terakhir, untuk contoh ini maka alamat broadcast = 192.168.0.255). Berapa nilai n? n = banyaknya angka 0 pada subnetmask (angka 0 dihitung pada nilai binary bukan desimal). Pada contoh di atas, berarti n = 8. Jadi jumlah host adalah 28 – 2 = 256 – 2 = 254 host.
Jadi jaringan dengan subnetmask 255.255.255.0 mempunyai jumlah host sebanyak 254 host. Pada tahap ini, terbukti bahwa IP class C bila tidak disubnet, maka akan mempunyai jumlah host sebanyak 254 host. Lalu bagaimana bila ternyata hanya terdapat 10 host saja? Seperti pernyataan yang terdapat di paragraf pertama, akan terjadi banyak sekali pemborosan. Di sinilah kegunaan subnetting.
Bila kita hanya mempunyai 10 host, maka kita dapat menggunakan subnetmask 255.255.255.240 untuk mengefisiensikan jaringan kita. Bagaimana cara mengetahuinya? Mari kita bersama-sama menghitungnya.
Jumlah Host = 2n – 2
10 <= 2n – 2
n = 4, diperoleh dari 2n – 2 yang mendekati 10
n mewakili host portion pada subnetmask. Karena host portion yang dipakai hanya 4, maka sisanya (4 bit) akan dipakai sebagai subnet portion. Seperti yang telah kita ketahui, n merupakan jumlah angka 0 dari subnetmask, dihitung/ditulis dari kanan. Dengan demikian, subnetmask subnetwork yang baru adalah 255.255.255.11110000 = 255.255.255.240.
NB: subnetmask dibagi menjadi 2 bagian, yaitu subnet portion (diwakili dengan angka 1 pada nilai binary) dan host portion (diwakili dengan angka 0 pada nilai binary). Untuk IP class C, nilai default subnet portionnya adalah 24 bit, dan host portionnya adalah 8 bit.
Dengan subnetmask 255.255.255.240, berapakah jumlah host maksimal dan berapa jumlah subnet yang dapat dibuat? Untuk menghitung jumlah host, digunakan rumus 2n – 2, n kecil mewakili jumlah angka 0 pada host portion. Sedang untuk menghitung jumlah subnet, kita dapat menggunakan rumus 2N – 2 (menurut cisco), N mewakili jumlah angka 1 pada host portion.
NB: untuk mencari jumlah subnet, ada yang menggunakan rumus 2N saja tanpa dikurangi 2. Hanya cisco yang mengurangkan dengan dua, karena secara default router cisco tidak menggunakan subnet ke-0 (kalau gak salah istilahnya “no ip zero subnet”) dan subnet yang terakhir digunakan untuk cadangan. Aku kurang paham tentang masalah ini.
Untuk contoh ini, maka klasifikasi jaringan yang baru adalah
Jumlah host/subnet = 2n – 2 = 24 – 2 = 14 host
Jumlah subnet = 2N – 2 = 24 – 2 = 14 subnet
Setelah kita menggunakan subnetmask 255.255.255.240, maka jaringan kita telah terbagi menjadi 14 subnet dengan jumlah maksimal host per subnet adalah 14 host. Lha kan Cuma ada 10 host doang? Ya gak papalah, memboroskan bandwidth untuk 4 host, masih lebih irit bila dibandingkan dengan 244 host, kan? Betul gak sih?
Klasifikasi jaringan 192.168.0.0/28
Subnet #0 (defaultnya tidak digunakan pada router cisco)
Alamat network = 192.168.0.0/28
Alamat host = 192.168.0.1/28 – 192.168.0.14/28
Alamat broadcast = 192.168.0.15/28
Subnet #1
Alamat network = 192.168.0.16/28
Alamat host = 192.168.0.17/28 – 192.168.0.30/28
Alamat broadcast = 192.168.0.31/28
Dan seterusnya...
NB: prefik /28 diperoleh dari default value (24) ditambah dengan jumlah host portion yang digunakan untuk subnet portion (4).
06.40 |
Category: |
1 comments
Tutorial Jaringan kali ini erat sekali hubungannya dengan tutorial
penulis sebelumnya, yakni mengenai “Koneksi 2 PC menggunakan kabel
Cross”, sehingga sebelum membaca artikel ini lebih lanjut, penulis
sarankan untuk membaca artikel tersebut.
Bagi seorang yang memiliki akses internet di rumah mungkin pernah
menemui kasus seperti bagaimana caranya membagi koneksi internet hanya
untuk 2 pc. Bisa saja menggunakan switch atau hub, kemudian memasangkan
kabel modem adsl ke dalam switch atau hub tersebut kemudian membagi
koneksi berdasarkan topologi jaringan star. Penulis rasa ini hanya
menghabiskan resource saja, dan dana yang keluar tentunya lebih besar
lagi. Kira-kira gambarannya adalah seperti ini :
Dibutuhkan satu buah switch, sekitar beberapa minggu yang lalu penulis
cek harga hub 8 port itu sekitar Rp 250 ribu. :(, dan dibutuhkan 2
kabel jenis strike, di tambah 4 buah RJ 45, hmmm... berapa kira-kira
dana yang habis di keluarkan ?? Kurang lebih sekitar Rp 270 ribu. :(
Mungkin bisa kurang. Tergantung yang jual temen atau bukan. Harga temen
sekitar ... Lah jadi jualan ?? :D~~
Beda halnya jika kita menggunakan topologi bus yang hanya membutuhkan
satu buah lan card tambahan, dipasang pada salah satu pc, dan satu buah
kabel jenis cross, tentunya bisa meminimalisir biaya yang akan
dikeluarkan, satu buah lan card harganya sekitar Rp 45 ribu. Sisanya
bisa dipakai untuk pedi cure dan medi cure ... :D~~ Ya, kira-kira
gambaran dari topologi bus yang dapat meminimalisir pengeluaran,
seperti ini :
Hanya dibutuhkan satu buah lancard tambahan, dan satu buah kabel cross.
Lan card tambahan dipasang di salah satu pc, dan pc ini harus terhubung
secara langsung ke modem adsl, seperti pada gambar di atas. Dengan kata
lain, 2 lan card inilah yang nantinya akan dijadikan sebagai bridge.
Perlu diketahui bridge dalam windows XP biasanya hanya memiliki satu
alamat IP.
Penulis tegaskan kembali, teknik yang satu ini berbeda dengan teknik
ketika anda membuat dial connection type PPoE (biasanya digunakan pada
broadband ADSL). Dial connection langsung dari PC berakibat pc yang
mendial connection tersebut akan memiliki IP Public. Nah itu adalah
alasan penulis membuat artikel ini. Dengan kata lain, pada teknik ini
yang memiliki ip public nantinya adalah si modem itu sendiri. Bukan PC
yang melakukan Dialing connection. PC di sini hanya berfungsi sebagai
bridge saja. Bukan mendial connection.
Setelah terpasang jaringan seperti pada gambar, langkah selanjutnya
adalah menyetting komputer yang memiliki 2 lan card tersebut.
1. Klik Start > Run > ketik Regedit [enter]
2. Masuk ke : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3. Ubahlah Nilai dari “IPEnableRouter” menjadi 1
4. Tutup Regedit.
5. Restart PC.
Langkah selanjutnya adalah membuat bridge dari 2 LAN Card pada pc
tersebut. Caranya adalah, masuk ke Control Panel Network Connection,
kemudian klik kanan dan pilih bridge connection.
Tunggu sebentar hingga terdapat 1 koneksi baru, yaitu network bridge.
Kemudian klik kanan Network Bridge tersebut, pilih properties, pada adapters centang 2 lancard yang akan dijadikan bridge,
pada This Connection Use the following items, pilih Internet Protocol
(TCP/IP) kemudian klik button Properties. Untuk pengisian IP Address,
di haruskan 1 class dengan modem adsl, pada gambar ini terlihat, PC
yang di jadikan Bridge mempunyai IP, 192.168.1.2, dan Modem ADSL
sebagai Gatewaynya adalah 192.168.1.1, Preferres DNS server di sini
adalah DNS milik ISP.
Selesai kemudian Ok.
Selanjutnya adalah settingan pada client, yakni di haruskan untuk
menggunakan IP Class yang sama dengna bridge, anda bisa menggunakan
192.168.1.3 – 192.168.1.254, dengan Default Gatewaynya mengarah kepada
Bridge, yakni 192.168.1.2, dan DNS Server mirip dengan propertiesnya
bridge. Ya, selesai, anda sudah dapat menggunakan fasilitas bridge ini
untuk berinternet ria.
Terima Kasih.
Greetz : b_scorpio, abuzahra, peterpanz, kandar, phii_, syahrilrohman,
ivan, dr.emi, safril, hg_, rux, d2n, dent_, minangmedia, riezno,
Lapak-online Team!
Sumber dari situs Ilmu Website dalam kategori jaringan dengan judul Sharing Internet untuk 2 PC dengan Bridge Windows
21.12 |
Category: |
0
comments
Mungkin anda sudah sering mendengar istilah Malware, namun kurang tahu maknanya.‘Malware” adalah program komputer yang diciptakan dengan maksud dan tujuan utama mencari kelemahan software. Umumnya Malware diciptakan untuk membobol atau merusak suatu software atau operating sistem.Contoh dari malware adalah Virus, Worm, Wabbit, Keylogger, Browser Hijacker, Trojan Horse, Spyware, Backdoor, Dialer, Exploit dan rootkit .
Virus
Inilah istilah yang sering dipakai untuk seluruh jenis perangkat lunak yang mengganggu computer. Bisa jadi karena inilah tipe malware pertama yang muncul.
Virus bisa bersarang di banyak tipe file. Tapi boleh dibilang, target utama virus adalah file yang bisa dijalankan seperti EXE, COM dan VBS, yang menjadi bagian dari suatu perangkat lunak. Boot sector juga sering dijadikan sasaran virus untuk bersarang. Beberapa file dokumen juga bisa dijadikan sarang oleh virus.
Penyebaran ke komputer lain dilakukan dengan bantuan pengguna komputer. Saat file yang terinfeksi dijalankan di komputer lain, kemungkinan besar komputer lain itu akan terinfeksi pula. Virus mencari file lain yang bisa diserangnya dan kemudian bersarang di sana.
Bisa juga virus menyebar melalui jaringan peer-to-peer yang sudah tak asing digunakan orang untuk berbagi file.
Worm
Worm alias cacing, begitu sebutannya. Kalau virus bersarang pada suatu program atau dokumen, cacing-cacing ini tidak demikan. Cacing adalah sebuah program yang berdiri sendiri dan tidak membutuhkan sarang untuk menyebarkan diri.
Hebatnya lagi, cacing bisa saja tidak memerlukan bantuan orang untuk penyebarannya. Melalui jaringan, cacing bisa “bertelur” di komputer-komputer yang terhubung dalam suatu kerapuhan (vulnerability) dari suatu sistem, biasanya sistem operasi.
Setelah masuk ke dalam suatu komputer, worm memodifikasi beberapa pengaturan di sistem operasi agar tetap hidup. Minimal, ia memasukkan diri dalam proses boot suatu komputer. Lainnya, mungkin mematikan akses ke situs antivirus, menonaktifkan fitur keamanan di sistem dan tindakan lain.
Wabbit
Istilah ini mungkin asing, tapi memang ada malware tipe ini. Seperti worm, wabbit tidak membutuhkan suatu program dan dokumen untuk bersarang.
Tetapi berbeda dengan worm yang menyebarkan diri ke komputer lain menggunakan jaringan, wabbit menggandakan diri secara terus-menerus didalam sebuah komputer lokal dan hasil penggandaan itu akan menggerogoti sistem.
Kinerja komputer akan melambat karena wabbit memakan sumber data yang lumayan banyak. Selain memperlambat kinerja komputer karena penggunaan sumber daya itu, wabbit bisa deprogram untuk memiliki efek samping yang efeknya mirip dengan malware lain. Kombinasi-kombinasi malware seperti inilah yang bisa sangat berbahaya.
Keylogger
Hati-hati kalau berinternet di warnet. Bisa saja pada komputer di warnet itu diinstall suatu perangkat lunak yang dikenal dengan istilah keylogger yang mencatat semua tekanan tombol keyboard.
Catatan yang disimpan dalam suatu file yang bisa dilihat kemudian itu lengkap. Di dalamnya bisa terdapat informasi seperti aplikasi tempat penekanan tombol dilakukan dan waktu penekanan. Dengan cara ini, seseorang bisa mengetahui username, password dan berbagai informasi lain yang dimasukkan dengan cara pengetikan.
Pada tingkat yang lebih canggih, keylogger mengirimkan log yang biasanya berupa file teks itu ke seseorang. Tentu saja itu dilakukan tanpa sepengetahuan si korban. Pada tingkat ini pula keylogger bisa mengaktifkan diri ketika pengguna komputer melakukan tindakan tertentu.
Misalnya begini. Ketika pengguna komputer membuka situs e-banking, keylogger aktif dan mencatat semua tekanan pada keylogger aktif dan mencatat semua tekanan pada keyboard aktif dan mencatat semua tekanan pada keyboard di situs itu dengan harapan nomor PIN dapat dicatat.
Keylogger ini cukup berbahaya karena secanggih apa pun enkripsi yang diterapkan oleh suatu website, password tetap dapat diambil. Pasalnya, password itu diambil sebelum sempat dienkripsi oleh system. Jelas dong. Keylogger merekam sesaat setelah password diketikkan dan belum diproses oleh system.
Browser Hijacker
Browser hijacker mengarahkan browser yang seharusnya menampilkan situs yang sesuai dengan alamat yang dimasukkan ke situs lain.
Itu contoh paling parah dari gangguan yang disebabkan oleh browser hijacker. Contoh lain yang bisa dilakukan oleh pembajak ini adalah menambahkan bookmark, mengganti home page, serta mengubah pengaturan browser.
Bicara mengenai browser di sini boleh yakin 100% browser yang dibicarakan adalah internet explorer. Selain karena internet explorer adalah buatan Microsoft, raksasa penghasil perangkat lunak yang produknya sering dijadikan sasaran serangan cracker, internet explorer adalah browser yang paling banyak digunakan orang berinternet. Tak heran, internet explorer telah menyatu dengan Windows, sistem operasi milik Microsoft yang juga banyak diserbu oleh cracker.
Trojan Horse
Kuda Troya adalah malware yang seolah-olah merupakan program yang berguna, menghibur dan menyelamatkan, padahal di balik itu, ia merusak. Kuda ini bisa ditunggangi oleh malware lain seperti seperti virus, worm, spyware. Kuda Troya dapat digunakan untuk menyebarkan atau mengaktifkan mereka.
Spyware
Spyware adalah perangkat lunak yang mengumpulkan dan mengirim informasi tentang pengguna komputer tanpa diketahui oleh si pengguna itu.
Informasinya bisa yang tidak terlampau berbahaya seperti pola berkomputer, terutama berinternet, seseorang sampai yang berbahaya seperti nomor kartu kredit, PIN untuk perbankan elektronik (e-banking) dan password suatu account.
Informasi tentang pola berinternet, telah disebutkan, tidak terlampau berbahaya. Situs yang dikunjungi, informasi yang kerap dicari, obrolan di ruang chat akan dimata-matai oleh si spyware.
Selanjutnya, informasi itu digunakan untuk menampilkan iklan yang biasanya berupa jendela pop-up. Iklan itu berhubungan dengan kebiasaan seseorang berinternet. Misalnya kerap kali seseorang mencari informasi mengenai kamera digital. Jendela pop-up yang muncul akan menampilkan, misalnya situs yang berdagang kamera digital. Adware adalah istilah untuk spyware yang begini.
Penyebaran spyware mirip dengan Trojan. Contohnya, flashget. Ketika flashget yang dipakai belum diregister, flashget bertindak sebagai spyware. Coba saja hubungkan diri ke internet, jalankan flashget yang belum diregister, cuekin computer beberapa saat, pasti muncul jendela internet explorer yang menampilkan iklan suatu situs.
Backdoor
Sesuai namanya, ini ibarat lewat jalan pintas melalui pintu belakang.
Dengan melanggar prosedur, malware berusaha masuk ke dalam sistem untuk mengakses sumber daya serta file. Berdasarkan cara bekerja dan perilaku penyebarannya, backdoor dibagi menjadi 2 grup. Grup pertama mirip dengan Kuda Troya. Mereka secara manual dimasukkan ke dalam suatu file program pada perangkat lunak dan kemudian ketika perangkat lunak itu diinstall, mereka menyebar. Grup yang kedua mirip dengan worm. Backdoor dalam grup ini dijalankan sebagai bagian dari proses boot.
Ratware adalah sebutan untuk backdoor yang mengubah komputer menjadi zombie yang mengirim spam. Backdoor lain mampu mengacaukan lalu lintas jaringan, melakukan brute force untuk meng-crack password dan enkripsi., dan mendistribusikan serangan distributed denial of service.
Dialer
Andaikata komputer yang digunakan, tidak ada hujan atau badai, berusaha menghubungkan diri ke internet padahal tak ada satu pun perangkat lunak yang dijalankan membutuhkan koneksi, maka layaklah bercuriga. Komputer kemungkinan telah terjangkit oleh malware yang terkenal dengan istilah dialer.
Dialer menghubungkan computer ke internet guna mengirim kan informasi yang didapat oleh keylogger, spyware tahu malware lain ke si seseorang yang memang bertujuan demikian. Dia dan penyedia jasa teleponlah yang paling diuntungkan dengan dialer ini.
Exploit dan rootkit
Kedua perangkat ini bisa dibilang malware bisa pula tidak. Kenapa begitu? Penjelasannya kira-kira begini.
Exploit adalah perangkat lunak yang menyerang kerapuhan keamanan (security vulnerability) yang spesifik namun tidak selalu bertujuan untuk melancarkan aksi yang tidak diinginkan. Banyak peneliti keamanan komputer menggunakan exploit untuk mendemonstrasikan bahwa suatu sistem memiliki kerapuhan.
Memang ada badan peneliti yang bekerja sama dengan produsen perangkat lunak. Peneliti itu bertugas mencari kerapuhan dari sebuah perangkat lunak dan kalau mereka menemukannya, mereka melaporkan hasil temuan ke si produsen agar si produsen dapat mengambil tindakan.
Namun begitu exploit kadang menjadi bagian dari suatu malware yang bertugas menyerang kerapuhan keamanan.
Berbeda dengan exploit yang secara langsung menyerang system, rootkit tidak demikian. Rootkit dimasukkan ke dalam komputer oleh penyerang setelah computer berhasil diambil alih.
Rootkit berguna untuk menghapus jejak penyerangan, seperti menghapus log dan menyembunyikan proses malware itu sendiri. Rootkit juga bisa mengandung backdoor agar di hari depan nanti, si penyerang bisa kembali mengambil alih system.
Rootkit ini sulit di deteksi, pasalnya rootkit ditanam pada system operasi di level kernel, level inti sistem operasi.
Cara terbaik yang bisa diandalkan untuk mendeteksi ada tidaknya rootkit di komputer adalah dengan mematikan komputer dan boot ulang tidak dengan harddisk melainkan dengan media lain seperti CD-ROM atau disket USB. Rootkit yang tidak berjalan tak dapat bersembunyi dan kebanyakan antivirus dapat mengidentifikasikannya.
Produsen perangkat keamanan biasanya telah mengintegrasikan pendeteksi rootkit di produknya. Meskipun rootkit di menyembunyikan diri selama proses pemindaian berjalan, antivirus masih bisa mengenalinya. Juga bila rootkit menarik diri dari system untuk sementara, antivirus tetap dapat menemukannya dengan menggunakan deteksi “sidik jari” alias byte unik dari rootkit.
Rootkit memang cerdik. Dia bisa menganalisis proses-proses yang sedang berjalan. Andai ia mencurigai suatu proses sebagai tindak tanduk antivirus, ia bisa menyembunyikan diri. Ketika prose situ selesai, ia aktif kembali.
Ada beberapa program yang bisa dipakai untuk mendeteksi adanya rootkit pada system. Rootkit detector kit, chkrootkit dan Rkhunter adalah contoh yang bisa digunakan.
Sumber:http://januar.wordpress.com/2006/12/12/malware/
05.50 |
Category: |
0
comments
Database administrator dan programer sering menggunakan SQL (Structured Query Language) untuk memberikan instruksi kepada database. Tetapi hati-hati, berikan instruksi yang tepat agar database Anda tidak ngambek. Joko Nurjadi
JIKA DIIBARATKAN manusia, database adalah sahabat yang patuh dan mengerti pada setiap perintah yang diberikan, sayangnya terkadang tidak berlaku sebaliknya, kita tidak patuh dan tidak mengerti pada “perintah” yang diberikan database.
Database kadang dapat “mengomel” dengan berbagai cara, bisa jadi dalam bentuk performance yang menurun, pesan kesala han, atau bahkan hasil laporan yang tidak sesuai. Semua-nya dapat kita minimalisasi, bahkan sebelum hal itu terjadi.
SQL dan RDBMS
Optimasi dapat dilakukan dengan berbagai cara, dengan memahami tuning performance pada database dan best practice dari berbagai sumber, Anda dapat memiliki fundamental yang kuat dalam mengoptimalkan kinerja database.
Beberapa teknik dan metoda mungkin memerlukan perlakuan khusus yang berbeda, tergantung pada database yang Anda gunakan.
Sebagai contoh, peningkatan kinerja bisa dilakukan dari sisi administrasi database seperti konfi gurasi file dan peng-updatean service atau security pack, yang tentunya masing-masing database memiliki keunikan dan teknik tersendiri.
Lalu, dengan pertimbangan kompatibilitas, adakah optimasi yang dapat dilakukan secara umum?
Terdapat seperangkat metode dan teknik yang umum diterapkan saat Anda bekerja dengan RDBMS (Relational Database Management System), mungkin tidak semuanya dapat Anda implementasikan karena sangat tergantung pada lingkungan aplikasi masing-masing, tetapi setidaknya Anda dapat meng-gunakannya sebagai panduan dan referensi untuk membentuk sistem yang terbaik sesuai dengan kondisi yang dihadapi.
Optimasi melalui perintah SQL juga memegang peranan yang tidak kalah penting. Inti dari SQL itu sendiri adalah perintah untuk melakukan pengambilan (retrieval), penambahan (insertion), modifikasi (updating), dan penghapusan (deletion) data, disertai dengan fungsi-fungsi pendukung administrasi dan managemen database.
SQL sendiri merupakan sebuah bahasa atau pemrograman standar untuk RDBMS. Walaupun disebut bahasa, mungkin sedikit janggal saat kita menyebut bahasa pemrograman SQL, lebih familiar jika yang terdengar adalah pemrograman C, Visual Basic, Java, Delphi, dan seterusnya.
Bahasa-bahasa yang disebut belakangan termasuk dalam pemrograman imperative, mudahnya adalah bahasa yang berbentuk instruksi-instruksi inti. Sedangkan, SQL termasuk dalam pemrograman declarative, yang lebih berbentuk kalimat atau pernyataan.
Dalam pengembangannya, SQL terbagi-bagi lagi dalam berbagai extension sehingga melahirkan berbagai sebutan seperti SQL/PSM (Persistent Stored Modules) yang merupakan standar ANSI/ISO, T-SQL (Transact-SQL) dari Microsoft dan SyBase, PL/SQL (PL merupakan singkatan dari Procedural Language) yang digunakan oleh Oracle, yang kemudian dikembangkan lagi menjadi PL/pgSQL yang digunakan PostgreSQL.
Cukup membingungkan, bukan? Untungnya konsep dan elemen-elemen dasar dalam SQL seperti statement, query, expression, ataupun clause tetap berlaku umum pada setiap SQL extension.
Kita cukupkan pembahasan teori sampai di sini, berikut adalah beberapa optimasi sederhana yang dapat Anda lakukan, untuk setidaknya memperbaiki atau mencegah permasalahan, dan meningkatkan performa RDBMS Anda.
Index
Optimasi pertama yang kita bahas adalah permasalahan index, tentu Anda mengetahui bahwa index dapat meningkatkan kecepatan pencarian pada record yang diinginkan. Tetapi, Anda harus cukup selektif dalam memilih field yang perlu di-index, karena tidak semua field memerlukannya.
Ibaratnya membaca buku, proses pencarian atau scan akan membaca dari awal hingga akhir halaman. Pada field yang di-index, pencarian dilakukan secara index scan, atau membaca pada index, tidak langsung pada table yang bersangkutan.
Sementara pencarian yang dilakukan langsung dengan membaca record demi record pada table disebut dengan table scan.
Apakah index scan selalu lebih cepat dibandingkan dengan table scan? Ternyata tidak juga, table scan bisa jadi bekerja lebih cepat saat mengakses record dalam jumlah relatif kecil, ataupun pada saat aplikasi memang memerlukan pembacaan table secara keseluruhan.
Sebaliknya dalam mengakses record yang besar pada field tertentu, index scan dapat mengurangi operasi pembacaan I/O sehingga tidak jarang menghasilkan kinerja yang lebih cepat.
Sebagai patokan, Anda dapat menentukan index pada field yang sering digunakan, misalnya field yang sering diakses oleh klausa WHERE, JOIN, ORDER BY, GROUP BY.
Menentukan Tipe Data
Tipe data merupakan permasalahan yang gampang-gampang susah. Dari sisi daya tampung, tipe data yang terlalu kecil atau sebaliknya terlalu besar bagi suatu field, dapat menimbulkan bom waktu yang menimbulkan masalah seiring dengan pertambahan data yang pesat setiap harinya.
Menentukan tipe data yang tepat memerlukan ketelitian dan analisa yang baik. Sebagai contoh, kita perlu mengetahui kapan kita menggunakan tipe data char atau varchar.
Keduanya menampung karakter, bedanya char menyediakan ukuran penyimpanan yang tetap (fi xed-length), sedangkan varchar menyediakan ukuran penyimpanan sesuai dengan isi data (variable-length).
Patokan umum adalah menggunakan tipe data char jika fi eld tersebut diperuntukkan untuk data dengan panjang yang konsisten. Misalnya kode pos, bulan yang terdiri dari dua digit (01 sampai 12), dan seterusnya. Varchar digunakan jika data yang ingin disimpan memiliki panjang yang bervariasi, atau gunakan varchar(max) jika ukurannya melebihi 8000 byte.
Jangan Izinkan Allow Null
Jika memungkinkan, kurangi penggunaan field yang memperbolehkan nilai null. Sebagai gantinya, Anda dapat memberikan nilai default pada field tersebut.
Nilai null kadang rancu dalam intepretasi programer dan dapat mengakibatkan kesalahan logika pemrograman. Selain itu, field null mengonsumsi byte tambahan sehingga menambah beban pada query yang mengaksesnya.
Query yang Mudah Terbaca
Karena SQL merupakan bahasa declarative, maka tidak mengherankan jika Anda membuat query berbentuk kalimat nan panjang walaupun mungkin hanya untuk keperluan menampilkan satu field!
Jangan biarkan query Anda susah dibaca dan dipahami, kecuali Anda memang berniat membuat pusing siapapun yang melihat query Anda. Query panjang yang ditulis dalam 1baris jelas akan menyulitkan modifi kasi dan pemahaman, akan jauh lebih baik jika Anda menuliskan query dalam format yang mudah dicerna.
Pemilihan huruf besar dan kecil juga dapat mempermudah pembacaan, misalnya dengan konsisten menuliskan keyword SQL dalam huruf kapital, dan tambahkan komentar bilamana diperlukan.
Hindari SELECT *
Select mungkin merupakan keyword yang paling sering digunakan, karena itu optimasi pada perintah SELECT sangat mungkin dapat memperbaiki kinerja aplikasi secara keseluruhan. \
SELECT * digunakan untuk melakukan query semua field yang terdapat pada sebuah table, tetapi jika Anda hanya ingin memproses field tertentu, maka sebaiknya Anda menuliskan field yang ingin diakses saja, sehingga query Anda menjadi SELECT field1, field2, field3 dan seterusnya (jangan pedulikan kode program yang menjadi lebih panjang!). Hal ini akan mengurangi beban lalu lintas jaringan dan lock pada table, terutama jika table tersebut memiliki banyak field dan berukuran besar.
Batasi ORDER BY
Penggunaan ORDER BY yang berfungsi untuk mengurutkan data, ternyata memiliki konsekuensi menambah beban query, karena akan menambah satu proses lagi, yaitu proses sort.
Karena itu gunakan ORDER BY hanya jika benar-benar dibutuhkan oleh aplikasi Anda.
Atau jika dimungkinkan, Anda dapat melakukan pengurutan pada sisi client dan tidak pada sisi server. Misalnya dengan menampung data terlebih dahulu pada komponen grid dan melakukan sortir pada grid tersebut sesuai kebutuhan pengguna.
Subquery Atau JOIN
Adakalanya sebuah instruksi dapat dituliskan dalam bentuk subquery atau perintah JOIN, disarankan Anda memprioritaskan penggunaan JOIN karena dalam kasus yang umum akan menghasilkan performa yang lebih cepat.
Walaupun demikian, mengolah query merupakan suatu seni, selalu ada kemungkinan ternyata subquery bekerja lebih cepat dibandingkan JOIN, misalnya dalam kondisi penggunaan
JOIN yang terlalu banyak, ataupun logika query yang belum optimal.
Gunakan WHERE dalam SELECT
“Di mana ada gula di sana ada semut”. Untuk programer database, pepatah itu perlu dimodifi kasi menjadi “di mana ada SELECT di sana ada WHERE”, untuk mengingatkan pentingnya klausa WHERE sebagai kondisi untuk menyaring record sehingga meminimalkan beban jaringan.
Saat sebuah table dengan jumlah data yang sangat besar diproses, juga terjadi proses lock terhadap table tersebut sehingga menyulitkan pengaksesan table yang bersangkutan oleh pengguna yang lain.
Bahkan jika Anda bermaksud memanggil seluruh record, tetap menggunakan WHERE merupakan kebiasaan yang baik.
Jika Anda telah menggunakan WHERE pada awal query, maka kapanpun Anda ingin menambahkan kondisi tertentu, Anda tinggal menyambung query tersebut dengan klausa AND diikuti kondisi yang diinginkan.
Tapi bagaimana menggunakan WHERE jika benar-benar tidak ada kondisi apapun? Anda dapat menuliskan suatu kondisi yang pasti bernilai true, misalnya SELECT .... WHERE 1=1. Bahkan tools open source phpMyAdmin yang berfungsi untuk mena ngani database MySQL selalu menyertakan default klausa WHERE 1 pada perintah SELECT, di mana angka 1 pada MySQL berarti nilai true.
Kecepatan Akses Operator
WHERE 1=1 dan WHERE 0 <> 1 sama-sama merupakan kondisi yang menghasilkan nilai true. Tetapi, dalam hal ini lebih baik Anda menggunakan WHERE 1=1 daripada WHERE 0 <> 1. Hal ini dikarenakan operator = diproses lebih cepat dibandingkan dengan operator <>.
Dari sisi kinerja, urutan operator yang diproses paling cepat adalah:
1. =
2. >, >=, <. <=
3. LIKE
4. <>
Tidak dalam setiap kondisi operator dapat disubtitusikan seperti contoh sederhana di atas, tetapi prioritaskanlah penggunaan operator yang tercepat.
Membatasi Jumlah Record
Bayangkan Anda menampilkan isi sebuah table dengan menggunakan SELECT, dan ternyata table tersebut memiliki jutaan record yang sangat tidak diharapkan untuk tampil seluruhnya.
Skenario yang lebih buruk masih dapat terjadi, yaitu query tersebut diakses oleh ratusan pengguna lain dalam waktu bersamaan!
Untuk itu, Anda perlu membatasi jumlah record yang berpotensi mengembalikan record dalam jumlah besar (kecuali memang benar-benar dibutuhkan), pada SQL Server, Anda dapat menggunakan operator TOP di dalam perintah SELECT.
Contohnya SELECT TOP 100 nama... akan menampilkan 100 record teratas field nama.
Jika menggunakan MySQL, Anda dapat menggunakan LIMIT untuk keperluan yang sama.
Batasi Penggunaan Function
Gunakan fungsi-fungsi yang disediakan SQL seperlunya saja.
Sebagai contoh, jika Anda menemukan query sebagai berikut: SELECT nama FROM tbl_teman WHERE ucase(nama) = ‘ABC’, nampak query tersebut ingin mencari record yang memiliki data berisi “abc”, fungsi ucase digunakan untuk mengubah isi field nama menjadi huruf besar dan dibandingkan dengan konstanta “ABC” untuk meyakinkan bahwa semua data “abc” akan tampil, walaupun dituliskan dengan huruf kecil, besar, ataupun kombinasinya.
Tetapi, cobalah mengganti query tersebut menjadi SELECT nama FROM tbl_teman WHERE nama = ‘ABC’, perhatikan query ini tidak menggunakan function ucase. Apakah menghasilkan result yang sama dengan query pertama? Jika pengaturan database Anda tidak case-sensitive (dan umumnya secara default memang tidak case-sensitive), maka hasil kedua query tersebut adalah sama. Artinya, dalam kasus ini Anda sebenarnya tidak perlu menggunakan function ucase!
Baca dari Kiri ke Kanan
Query yang Anda tulis akan diproses dari kiri ke kanan, misalkan terdapat query WHERE kondisi1 AND kondisi2 AND kondisi3, maka kondisi1 akan terlebih dahulu dievaluasi, lalu kemudian kondisi2, kondisi3, dan seterusnya. Tentunya dengan asumsi tidak ada kondisi yang diprioritaskan/dikelompokkan dengan menggunakan tanda kurung.
Logika operator AND akan langsung menghasilkan nilai false saat ditemukan salah satu kondisi false, maka letakkan kondisi yang paling mungkin memiliki nilai false pada posisi paling kiri. Hal ini dimaksudkan agar SQL tidak perlu lagi mengevaluasi kondisi berikutnya saat menemukan salah satu kondisi telah bernilai false.
Jika Anda bingung memilih kondisi mana yang layak menempati posisi terkiri karena kemungkinan falsenya sama atau tidak bisa diprediksi, pilih kondisi yang lebih sederhana untuk diproses.
Gambar dalam Database
Database memang tidak hanya diperuntukkan sebagai penyimpanan teks saja, tetapi dapat juga berupa gambar. Kalau pepatah mengatakan sebuah gambar bermakna sejuta kata, tidak berarti kita harus menyediakan tempat penyimpanan seukuran sejuta kata untuk menampung satu gambar! Akan lebih baik bagi kinerja database jika Anda hanya menyimpan link ataulokasi gambar di dalam database, dibandingkan menyimpan fisik gambar tersebut.
Kecuali jika Anda tidak memiliki pilihan lain, misalnya karena alasan keamanan atau tidak tersedianya tempat penyimpanan lain untuk gambar Anda selain di dalam database.
Tetapi, jelas jika Anda dapat memisahkan gambar secara fisik dari database, maka ukuran dan beban database akan relatif berkurang drastis, proses seperti back-up dan migrasi akan lebih mudah dilakukan.
Pengukuran Kinerja
Terdapat tools optimizer yang bervariasi untuk tiap RDBMS, Anda dapat menggunakannya sebagai panduan untuk meningkatkan kinerja query, di mana Anda dapat mengetahui berapa lama waktu eksekusi atau operasi apa saja yang dilakukan sebuah query.
Jika Anda menemukan sebuah query tampak tidak optimal, berusahalah menulis ulang query tersebut dengan teknik dan metode yang lebih baik. Semakin banyak query yang dapat dioptimasi, akan semakin baik kinerja aplikasi Anda. Terutama saat frekuensi pemakaian query tersebut relatif tinggi.
Back-up
Buatlah back-up otomatis secara periodik, sebaiknya tes dan simulasikan prosedur restore database dan perhitungkan waktu yang diperlukan untuk membuat sistem pulih kembali jika terjadi sesuatu yang tidak diharapkan pada database.
Lakukan proses back-up pada waktu di mana aktivitas relatif rendah agar tidak mengganggu kegiatan operasional.
Banyak Jalan Menuju Roma
Berikan satu masalah pada beberapa programer, maka Anda mungkin akan mendapatkan beberapa solusi yang berbedabeda. Banyak alternatif yang dapat diciptakan untuk menghasilkan sesuatu, tetapi tentunya kita menginginkan alternatif yang terbaik.
Karena itu, jangan ragu mencoba menuliskan ulang query Anda dengan cara lain jika Anda melihat kemungkinan peningkatan kinerja, contohnya pada potongan query berikut:
WHERE SUBSTRING(nama,1,1) =’b’
Query di atas akan mengambil record dengan kondisi karakter pertama kolom nama adalah “b”, sehingga akan tampil isi record seperti “Budi”, “Badu”, “Benny” dan seterusnya. Cara lain untuk menghasilkan record yang sama adalah sebagai berikut:
WHERE nama LIKE ‘b%’
Hasil yang ditampilkan kedua query tersebut akan sama, tetapi performa yang dihasilkan (terutama untuk record berukuran besar) akan berbeda. Umumnya kondisi LIKE akan bekerja dengan lebih cepat dibandingkan function SUBSTRING.
Contoh lain yang lebih kompleks adalah seperti query beri-kut:
SELECT NIP, nama FROM tbl_pegawai WHERE dept = ‘IT’ OR kota
= ‘jakarta’ OR divisi = ‘programer’
Perhatikan query di atas memiliki tiga kondisi yang dipisahkan oleh klausa OR. Alternatif lain adalah dengan menuliskan query sebagai berikut:
SELECT NIP, nama FROM tbl_pegawai WHERE dept = ‘IT’
UNION ALL
SELECT NIP, nama FROM tbl_pegawai WHERE kota = ‘jakarta’
UNION ALL
SELECT NIP, nama FROM tbl_pegawai WHERE divisi = ‘programer’
Walaupun penulisan query menjadi lebih panjang, bisa jadi al-ternatif ini akan lebih baik. Mengapa? Dengan asumsi field dept memiliki index, sementara field kota dan divisi tidak diindex, query pertama tidak akan menggunakan index dan melakukan table scan. Berbeda dengan query kedua, index akan tetap dilakukan pada sebagian query sehingga akan menghasilkan kinerja yang relatif lebih baik.
Ah... Beda Tipis Saja!
Pastinya masih banyak terdapat teknik lain yang tidak akan dapat dibahas semuanya dalam artikel ini. Di antara (atau mungkin semua) teknik optimasi yang dibahas di atas, mungkin Anda akan menemukan bahwa setelah diuji dengan data sampel maka kinerja sebelum dan sesudah optimasi ternyata sama sekali tidak signifikan, beda tipis, atau tidak ada bedanya sama sekali!
Memang benar, dengan spesifi kasi hardware yang semakin meningkat, data yang relatif kecil, dan alur yang sederhana, Anda mungkin tidak akan mendapatkan perbedaan yang signifikan.
Tetapi jika Anda siap untuk terjun menghadapi tantangan menangani aplikasi yang lebih besar, maka perbedaan antara tanpa dan dengan optimasi akan sangat nyata, dengan pema-haman dan kebiasaan coding yang baik, Anda akan dapat menghasilkan aplikasi yang juga lebih baik.
Tidak ada salahnya menerapkan optimasi yang Anda ketahui sedini mungkin dalam pengembangan sistem aplikasi Anda.
Bahkan jika sebuah aplikasi tnampaknya memiliki kinerja yang cukup baik, tidak berarti lepas dari usaha optimasi lebih lanjut.
Terutama jika Anda mengharapkan aplikasi tersebut mampu berkembang lebih jauh, tidak pernah ada kata sempurna bagi suatu sistem aplikasi, tetapi setiap sistem selalu ada kesempatan menjadi lebih berguna. Salah satunya dengan selalu mencari cara yang lebih baik
LEBIH LANJUT
· http://blog.sqlauthority.com/
· http://blogs.msdn.com/queryoptteam/
06.01 |
Category: |
0
comments
