<div class="gmail_quote">On Fri, Apr 23, 2010 at 8:46 PM, Jon Spriggs <<a href="mailto:jon@spriggs.org.uk">jon@spriggs.org.uk</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Just to explain why the ping test is probably in Shields-up, is that... In times long-gone, and around about when Shields-Up was being created, many people would be using Dial-up, and even getting a ping from an IP address in a dial-up range would make you a fair target (as it was likely that would be an unprotected host). </blockquote><div><snip> Just to add to this comment, if someone was searching for a target, then it takes less time to only port scan targets that are visibly "there". The main reason why ping being enabled is a problem is it makes it more likely for you to be scanned against particular service ports thereafter, however with an appropriate firewall policy and security policy (eg using fail2ban - <a href="http://www.fail2ban.org">www.fail2ban.org</a> if running an ssh server) For example, if you were to nmap scan an entire /24 internet subnet (254 hosts) on all service ports using the -PN switch (do not ping) in nmap, that would take a long while - the checks would be carried out against all hosts and all ports would be tested regardless of whether they were pingable. This is not necessarily a desirable result, as primarily, it will take *ages* to complete the scan - therefore it makes sense to verify the targets first by pinging them, thus reducing the time taken to run a scan. There are many (thousands of) other options for scanning, and if you are interested in learning more then the nmap book by Fyodor is a great resource, and is available as a free, truncated version online <a href="http://nmap.org/book/toc.html">http://nmap.org/book/toc.html</a>. IMHO nmap is an invaluable tool for testing firewall configs, mapping networks, and even for identifying machines that exist on your own network, when you might have forgotten what they do or see some unusual activity from them in your firewall logs (nmap -sS -sV -O -PN 192.168.1.55 will tell you in most cases the operating system, open ports, application versions using those ports and the operating system of a host!) Kind regards Paul </div></div>