Dark Mode

Settings

Capec-309 Detail

Network Topology Mapping

Standard Software Typical Severity: Low

Parents: 169

Children: 290 291 293 643

Threats: T60 T65 T80 T105 T258 T273 T288 T291 T302 T334 T392 T407

Tools: 5

Description

An adversary engages in scanning activities to map network nodes, hosts, devices, and routes. Adversaries usually perform this type of network reconnaissance during the early stages of attack against an external network. Many types of scanning utilities are typically employed, including ICMP tools, network mappers, port scanners, and route testing utilities such as traceroute.

Not present

External ID Source Link Description
CAPEC-309 capec https://capec.mitre.org/data/definitions/309.html
CWE-200 cwe http://cwe.mitre.org/data/definitions/200.html
T1016 ATTACK https://attack.mitre.org/wiki/Technique/T1016 System Network Configuration Discovery
T1049 ATTACK https://attack.mitre.org/wiki/Technique/T1049 System Network Connections Discovery
T1590 ATTACK https://attack.mitre.org/wiki/Technique/T1590 Gather Victim Network Information
REF-33 reference_from_CAPEC Stuart McClure, Joel Scambray, George Kurtz, Hacking Exposed: Network Security Secrets & Solutions (6th Edition), 2009, McGraw Hill
REF-128 reference_from_CAPEC http://www.faqs.org/rfcs/rfc793.html Defense Advanced Research Projects Agency Information Processing Techniques Office, Information Sciences Institute University of Southern California, RFC793 - Transmission Control Protocol, 1981--09, Defense Advanced Research Projects Agency (DARPA)
REF-130 reference_from_CAPEC http://phrack.org/issues/51/11.html Gordon "Fyodor" Lyon, The Art of Port Scanning (Volume: 7, Issue. 51), Phrack Magazine, 1997

Not present

  1. None
  1. Probing requires the ability to interactively send and receive data from a target, whereas passive listening requires a sufficient understanding of the protocol to analyze a preexisting channel of communication.

Not present

Confidentiality
Other

Not present