Reconnaissance attacks are a critical initial phase in many cyberattacks, where attackers gather information about potential targets before launching more invasive attacks. Here’s a breakdown of the key reconnaissance techniques mentioned:

1. IP Probes (IP Sweeps or Ping Sweeps):
   • Purpose: To identify active devices within a network by sending ping requests to a range of IP addresses.
   • Process: Automated tools attempt to ping each address in a range. If a device responds, it’s logged for further investigation. Non-responsive addresses are typically ignored, assumed to be unused.
   • Tools: Common tools like nmap are used for these probes. These tools are frequently employed to discover live systems within a target network.
2. Nmap Tool:
   • Functionality: Nmap is a widely used tool for performing both IP probes and port scans. It helps attackers (and security professionals) determine the state of various network ports on a system.
   • Port States:
     • Open: An application is actively accepting connections on the port.
     • Closed: The port is accessible but no application is accepting connections.
     • Filtered: The port’s status is indeterminate due to firewall interference.
3. Port Scans:
   • Purpose: After identifying active systems through IP probes, attackers use port scans to discover what services are running on those systems.
   • Targeting: Attackers often look for specific services like web servers (e.g., scanning for port 80, which is used by HTTP) to focus their attacks on high-value targets.
4. Vulnerability Scans:
   • Purpose: Once a system is selected as a target, attackers use vulnerability scanners to find specific security flaws that can be exploited.
   • Tools: Popular vulnerability scanners include Nessus, OpenVAS, Qualys, Core Impact, and Nexpose. These tools have extensive databases of known vulnerabilities and can generate detailed reports on the security weaknesses of the targeted systems.
   • Exploitation: After identifying vulnerabilities, attackers often search for existing scripts or exploits that can be used to take advantage of these weaknesses and gain unauthorized access.

These reconnaissance techniques are foundational in many cyberattack strategies, making it essential for defenders to monitor and mitigate such activities through network security measures, such as disabling unnecessary services, restricting access to ports, and employing robust firewall rules.