Copyright Goodheart-Willcox Co., Inc. Chapter 8 Overview of Network Security and Network Threats 275 to validate IP addresses in use. However, hackers can use the same information to probe a subnet and fi nd potential targets. Special software is not needed to do ping sweeps. A simple batch fi le can be created to perform this task. However, there are many open-source tools to pro- vide this functionality, as shown in Figure 8-24. Two popular programs include Advanced IP Scanner and Angry IP Scanner. Both of these programs offer features such as remote administration, cross-platform capability, MAC address identifi ca- tion, and more. Hackers also do not need access to a computer to install one of these pro- grams. Due to the many portable apps that are available, they just need access to the network and unblocked ICMP connections on the hosts. Attacker Victim (server) TCB sets connection to SYN-RECEIVED Attacker Victim (server) Attacker Victim (server) Previous TCB session is still open new TCB sets connection to SYN-RECEIVED SYN SYN SYN/ACK Goodheart-Willcox Publisher photos: Denis Rozhnovsky/Shutterstock.com Figure 8-23. In a SYN flood, the TCB is never closed since no ACK is received. Ping Sweeps Your company provides IT services to other businesses. A customer has recently experienced some malware attacks. It is looking for solutions that will reduce the possibility of unknown devices connected to its network. You propose doing a ping sweep to search for all devices on the customer’s subnets. The customer is unaware of this reconnaissance method and is a little unsure of this plan of action. In a report to the customer, explain how a ping sweep uses the ICMP protocol to obtain this information on connected hosts such as computers and tablets. Explain how a ping sweep can be used to identify devices on a subnet. Explain why this an ethical action. Also, describe how hackers could unethically use this tool to scout for vulnerabilities. Ethical Issue