1

First, just a bit of background:

My ISP has decided to block all inbound connections (from their customers' perspective) which effectively means that I can no longer host anything on my connection (FTP, HTTP etc.) or use any of a number of programs that require one or more listening ports to be specified for use by inbound connections (SSH, RDP, uTorrent, etc. etc.)

Apparently they recently "suffered" a port scan attack on an entire IP range that has been allocated for use by their subscribers and their reasoning now (as a metered-bandwidth ISP) is that allowing inbound connections again will generate too much additional, unsolicited traffic which the majority of their subscribers will not be willing to pay for (or even understand where it's coming from).

I disagree in that, in the grand scheme of things, I don't think a bunch of SYN packets and the resulting NACK (?) packets as sent back from a host-based firewall (for example) will end up causing THAT much additional traffic.

My question is whether there is any way in which I can measure the amount of bandwidth that such a port scan will typically generate if I were to scan all the ports on my own machine? nmap is ideal for this, but I'm not sure how one would measure the total bandwidth (including the 'reject' packets sent back from the target machine, if any).

I am fairly proficient with the bash shell and know my way around Linux. Any help would be greatly appreciated!

Improve this question

2 Answers 2

Reset to default
3

You can use iptables(add allow rules)

Scanning host 8.8.8.8:

# iptables -I INPUT 1 -s 8.8.8.8 -j ACCEPT
# iptables -I OUTPUT 1 -d 8.8.8.8 -j ACCEPT
# iptables -Z && nmap -O 8.8.8.8
# iptables -vn -L
Chain INPUT (policy ACCEPT 273 packets, 17374 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    8   320 ACCEPT     all  --  *      *       8.8.8.8              0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 140 packets, 13386 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2043 94224 ACCEPT     all  --  *      *       0.0.0.0/0            8.8.8.8
Improve this answer
3
  • 1
    Thanks, that was pretty straightforward. If anyone is interested, the scan I ran completed in 115s and it took a total of 2,062 bytes. If my math is correct and assuming a lot of things that shouldn't be assumed, that would work out to around 45.8 MB if I were to scan the target IP continuously for a whole month.
    – Xhantar
    Feb 22, 2011 at 14:26
  • Sorry to be so late, and to be the bearer of bad news... but the scan you ran is the default scan. It only checks 1000 ports. You'll find that a full scan (65535 ports, which you can call using -p 1-65535) actually generates about 4.5MB of traffic for each host.
    – Très
    May 27, 2014 at 3:04
  • would be nice to have a tool like 'time' which give you the total traffic generated by it's sub-process, e.g. 'traffic nmap ...'
    – alfwatt
    Feb 5, 2015 at 20:51
1

You could probably use tcpdump or wireshark to measure the traffic. But be sure to disable all other traffic, web-browsers, mail clients, ntp updates, skype or any pther chat software, etc. Or just disconnect all clients.

Or just filter the right traffic with tcpdump or wireshark.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .