Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to determine the systems with vulnerability, which scanning tool is best. The system should be identified so that it can be used as agent for DDoS. In a test bed environment I want to check this. Can anyone help?

share|improve this question

migrated from Mar 31 '10 at 10:26

This question came from our site for professional and enthusiast programmers.

Not directly related to your question but a idea that may become handy somewhere in the future is the concept of enabling netflow in your network infrastructure.

Once your network devices start reporting network flows to a netflow collector you can relatively easy detect which machines are being used as part of a DDoS campaign. Those that shows a spike in the number of flows per second may very well be the ones that are already compromised and used as a DDoS tool to disable a target (netflow has many other uses in security).

There are many other "traffic engineering" techniques that are useful to detect this kind of behavior in an enterprise network (and many others in a service provider environment).

For example through traffic engineering (routing) you could "attract" all the traffic destined to the IP address space (i.e. RFC1918/RFC5735) that your organization is not using into a device that is commonly referred to as the "sinkhole". You should normally never see traffic in the sinkhole, but if you do, it may be signaling the presence of compromised machines in your infrastructure that are generating traffic to IP addresses that are not valid inside your organization. Because you are "attracting" this traffic, they end at the sinkhole. This behavior may also be the result of infected machines scanning your organization searching for victims to further spread, etc.

share|improve this answer

Any system can become compromised and be used for DDoS. To remotely scan a system to see if it is vulnerable to attack you can use OpenVAS. Compromised machines are also used to send spam, many ip addresses on a Realtime Black List are also members of a botnet which are often used for DDoS.

share|improve this answer

A combined use of nmap and metasploit can help you detect a vulnerability and launch an attack in a test environment.

share|improve this answer

Try OpenVas

The URL is

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.