CRU Ditto Forensic FieldStation User Manual
Page 30
30
Protecting Your Digital Assets
TM
Ditto Forensic FieldStation User Manual
•
Will scan only hosts 10.10.10.2 and 10.10.10.3
5. Combo: 10.10.10.1,10.10.10.2,10.10.10.50-100
•
Will scan hosts 10.10.10.1, 10.10.10.2 and hosts 10.10.10.50 through 10.10.10.100.
Discovery Options
There are three optional host (machine) discovery options and one “No Ping” port scan option avail-
able. By default, the “Ping Echo” option is enabled and will suffice for most use cases. Some machines
may be configured to ignore pings and not respond, so there are two other specialized Ping options
which may be useful. Click the “Reset” icon to reload the default settings.
•
Ping Echo:
Sends a standard ICMP echo request to each IP address.
•
Ping Timestamp:
Sends a request for a timestamped ICMP packet.
•
Ping Netmask:
Sends a request for the destination’s subnet mask using an ICMP packet.
•
No Ping:
Skips host discovery and forces a port scan, which is useful when the hosts appear
to be down.
•
Timing:
Selects a timing interval for scanning a network. “3” is the default setting. Lower
numbers are slower and will help you avoid triggering an intrusion detection alert, and higher
numbers are faster but may be less accurate, and may cause intrusion detection alerts.
TCP Options
NetView can optionally scan the specified hosts for open TCP ports. By default, this feature is not
enabled. Check the box next to “TCP Options” to enable this feature and expand more options. Click
the “Reset” icon to reset all TCP Options back to their default values.
•
Ports:
By default, TCP ports for commonly used services as well as services to which the Ditto
Forensic FieldStation may be able to connect are entered into this text box, including ports
for NFS, iSCSI, and Samba. Only ports entered into this text box will be scanned. NetView IP
port ranges may be specified as any combination of lists and ranges. Valid port numbers are
Figure 28.
The “Action” section on the “Home” screen, showing
the options available for the “Netview Scan” action.