Description & Architecture

Ghosstless Security (Network Mapper) is an open source tool for network exploration and perimeter security audit. It was designed to quickly scan large-scale networks but operates with the same precision against individual hosts.

It uses raw IP packets with new forms to determine what hosts are available on the network, what services (name of the application and version) they are offering, what operating systems (and kernel versions) are running, what kind of package and firewalls filters are in use and dozens of other infrastructure features.

The main result of any scanning is that interesting port table. That table lists the port number, protocol (TCP or UDP), name of service and current port status:

• Open (Abierto): A target machine application is actively listening to connections or packages at this port.
• Filtered (Filtrado): A firewall, network filter or obstacle blocks the port and prevents them from determining whether it's open or closed.
• Closed (Cerrado): The port has no listening applications but responded appropriately to the probes (sending RST packets).
• Unfiltered (No filtrado): The port is accessible to the probes but cannot be sure if it's open or closed.

In addition to the port table, Ghosstless can provide detailed information about inverse DNS names (RDNS), Fingerprinting TCP-based operating system predictions, device types (routers, printers, switches, servers), network distances using traceroute leaps and MAC physical addresses with dedicated manufacturer.