-
Notifications
You must be signed in to change notification settings - Fork 9
FAQs
Here's a list of our frequently asked questions and a glossary of terms that are commonly mentioned in the lift documentation.
Port mapping software, like nmap, tries to answer two questions:
- Which network services are running on this device?
- From which ports can these services be accessed?
Port mapping software is driven by service discovery, and identification is often a secondary or tertiary goal. Lift assumes that services are running on whichever port you specify, and focuses exclusively on the identification of the device. LIFT IS NOT A REPLACEMENT FOR PORT MAPPING SOFTWARE. Lift is not a swiss army knife, but rather a single tool with a defined scope, much like a hammer or screwdriver. A complete toolbox contains masscan for massive scans, nmap for service enumeration and port mapping, and lift for identification.
Do knives kill people? No. People with knives do. This is a tool. Wield accordingly.
Stay tuned for a comparison of how long it takes to identify 10,000 IP addresses using the lift tool versus alternatives.
Low impact could also mean low interaction. The goal of this was to be a quick and quiet way to identify devices without the devices knowing. Originally, lift used only default ssl certs to detect devices, which is the lowest possible interaction. Due the way lift is written, detection via SSL will not generate a log entry in most cases. How? It does this by opening an SSL/TLS socket connection, negotiating the cert and disconnecting. If this yields no results, it will do a get request to port 443. If that fails then a get to port 80. The goal is to not be noisy. Also, some IoT devices do not respond well to nmap and topple over if heavily port scanned.
Stay tuned.
Below is an example of a device toppling over from NMAP scans.
Force 10 S55 series suffered from a fun little bug.
Severity: S2 Synopsis: System may report spurious memory allocation failure errors when NMAP port scanner utilities are executed >against the switch. Release Notes: System may incorrectly report memory allocation failure errors when NMAP port scanner utilities are executed against the switch. Workaround: None.
The memory allocation errors were actually because running a standard port scan would cause the service running on port 47123 (process was called sysd) to get stuck and use 99% of the CPU. I had to do rolling reboots of 64 switches in one night. Three never came back up.
Stay tuned for an example of a log file on a device that is being scanned by nmap.