Table of Contents

Document Objectives
Audience
Document Organization
Important Terms Used in This Guide
Related Documentation
Document Conventions
Cisco Connection Online
Documentation CD-ROM

About This Guide

This preface describes:

• Document Objectives

• Audience

• Document Organization

• Important Terms Used in This Guide

• Related Documentation

• Document Conventions

• Cisco Connection Online

• Documentation CD-ROM

Document Objectives

The guide explains how to install and use Cisco Secure Scanner (formerly sold as NetSonar), the vulnerability scanning and network mapping software.

Audience

This guide is intended for users who have either purchased or are evaluating the Scanner. This guide provides information for those users who need to perform the following tasks:

• Install and configure the Scanner

• Operate the Scanner to scan or probe a network for vulnerabilities

• Learn more about network vulnerabilities and network security

Document Organization

This guide is organized into the following chapters and appendixes:

• Chapter 1, "Cisco Secure Scanner Overview," provides a basic overview of the Scanner features and components, and the various tasks you can perform using this network mapping and vulnerability analysis tool.

• Chapter 2, "Installing Cisco Secure Scanner for Windows NT," identifies the hardware, software, and operating system requirements for the Scanner for Windows NT and explains how to install the Scanner software. It also explains how to uninstall, start, and stop the Scanner for Windows NT.

• Chapter 3, "Installing Cisco Secure Scanner for Solaris," identifies the hardware, software, and operating system requirements for the Scanner for Solaris and explains how to install the Scanner software. It also explains how to uninstall, start, and stop the Scanner for Solaris.

• Chapter 4, "Licensing Cisco Secure Scanner," explains the procedure for licensing the Scanner software.

• Chapter 5, "Using Cisco Secure Scanner," explains how to set up the user preferences for the Scanner.

• Chapter 6, "Creating Sessions," gives instructions on how to set up sessions for a single IP address and for ranges of IP addresses.

• Chapter 7, "Viewing Data Results," explains how to view session results.

• Chapter 8, "Creating Charts," gives instructions for creating charts from session data obtained.

• Chapter 9, "Generating Reports," gives instructions for generating reports from session data.

• Chapter 10, "Network Security Database," explains what the NSDB is and how to use it.

• Appendix A, "Customizing Reports," provides information on how to customize reports according to your needs.

• Appendix B, "User-defined Rules," explains how to write your own vulnerability rules for the Scanner.

• Appendix C, "Troubleshooting," provides information for resolving issues with the Scanner.

Important Terms Used in This Guide

This section defines various terms denoting Scanner-specific functions and capabilities used throughout this guide.

authentication, authorization, and accounting (pronounced "triple a").

The systematic implementation of the security policy. To actively audit, verify, detect intrusion and anomalies, and report findings.

Data structure or logical convention used to identify a unique entity, such as a particular process or network device.

Allows a user to retrieve documents, files, programs, and other archived data from anywhere on the Internet without having to establish a userid and password. By using the special userid of anonymous, the network user will bypass local security checks and will have access to publicly accessible files on the remote system. See FTP.

Application Programming Interface. Specification of function-call conventions that defines an interface to a service.

American Standard Code for Information Interchange. 8-bit code for character representation (7 bits plus parity). A text file containing only letters, numbers, and symbols. An ASCII file contains no formatting.

The verification of the identity of a person or process.

The vertical rows and horizontal columns in the Grid Browser.

The Scanner uses charts (pie, bar, column, and so forth) to display session data.

Term used to describe distributed computing (processing) network systems in which transaction responsibilities are divided into two parts: client (front end) and server (back end). Both terms (client and server) can be applied to software programs or actual computing devices. Also called distributed computing (processing).

The Scanner uses active probing techniques to confirm the vulnerability.

The ability to change your perspective on the data in the Grid Browser, for example, to view all hosts running a particular service, all services associated with one host, all vulnerabilities associated with one host, or all hosts with a particular vulnerability.

Domain Name System. System used in the Internet for translating names of network nodes into addresses.

Denial of service. One user takes up so much of a shared resource that none of the resource is left for other users. Denial of service attacks compromise the availability of the resources, for example, processes, disk space, percentage of CPU, printer paper, modems, or the time of a system administrator. This results in degradation or loss of service.

Double-clicking an object, icon, or token on a tree that brings you "down" to the next level below that object. For example, in the Grid Browser you can drill down from a cell to view host-level detail.

A profile of all live hosts at the particular time a Scanner session is run.

The process of making information indecipherable to protect it from unauthorized viewing or use, especially during transmission or when it is stored on a transportable magnetic medium.

A set of one or more procedures that takes advantage of one or more vulnerabilities in order to gain access to a system, deny system services to valid users, or collect system information that may reveal additional vulnerabilities.

Router or access server, or several routers or access servers, designated as a buffer between any connected public networks and a private network. A firewall router uses access lists and other methods to ensure the security of the private network.

File Transfer Protocol. Application protocol, part of the TCP/IP protocol stack, used for transferring files between network nodes. FTP is defined in RFC 959.

The Scanner's patent-pending, multidimensional database that shows the results of a given Scanner session in tabular form. It uses a hyperlinked spreadsheet to present the data accumulated per session.

Any device that is attached to a network and uses TCP/IP.

Hypertext Markup Language. Simple hypertext document formatting language that uses tags to indicate how a given part of a document should be interpreted by a viewing application, such as a Web browser.

Hypertext Transfer Protocol. The protocol used by Web browsers and Web servers to transfer files, such as text and graphic files.

Internet Control Message Protocol. Network layer Internet protocol that reports errors and provides other information relevant to IP packet processing. Documented in
RFC 792.

Internet Protocol. Network layer protocol in the TCP/IP stack offering a connectionless internetwork service. IP provides features for addressing, type-of-service specification, fragmentation and reassembly, and security. Defined in RFC 791.

Internet Protocol Address. Used to identify a node on a network and to specify routing information. Each node on the network must be assigned a unique IP address, which is made up of the network ID plus a unique host ID assigned by the network administrator. This address is typically represented in dotted decimal notation with the decimal value of each octet separated by a period (for example, 172.16.0.0).

Local Area Network. A group of computers and other devices dispersed over a relatively limited area and connected by a communications link that enables any device to interact with any other on the network.

Message Digest 5. Algorithm used for message authentication in SNMP v.2. MD5 verifies the integrity of the communication, authenticates the origin, and checks for timeliness. See also SNMP2.

Network File System. A service for distributed computing system that provides a distributed file system thus eliminating the need for keeping multiple copies of files on separate computers.

Network Security Database. A Cisco-proprietary, HTML database that is a comprehensive repository of vulnerability rules that identifies known security risks. It explains the impact a particular vulnerability can have on your network, gives potential countermeasures, and links to specific web sites for more information.

Nonintrusive queries that the Scanner uses to get security-relevant information. The Scanner interrogates network services by issuing special, protocol-specific commands when simply connecting to an active network service does not yield the vulnerability information for which is it searching.

Logical grouping of information that includes a header containing control information and (usually) user data. Packets are most often used to refer to network layer units of data. The terms datagram, frame, message, and segment are also used to describe logical information groupings at various layers of the OSI reference model and in various technology circles.

A security measure used to restrict logons to user accounts and access to computer systems and resources. A password is a unique string of characters that must be provided before a logon or access is authorized.

packet internet groper. ICMP echo message and its reply. Often used in IP networks to test the reachability of a network device.

Interface on an internetworking device (such as a router).

An attempt to count the services running on a machine by probing each port for a response. Also known as a port sweep.

Information retrieved from the target host that suggests the vulnerability may exist. The Scanner has not attempted to exploit it in order to confirm it. The Scanner shows potential vulnerabilities based solely on the fact that a certain version of an operating system or application has been found in a certain scanned host.

A probe is an intrusive analysis technique that uses the information obtained during scanning to more fully interrogate each network device. The probe uses well-known exploitation techniques to fully confirm each suspected vulnerability as well as to detect any vulnerabilities that cannot be found using nonintrusive techniques.

Formal description of a set of rules and conventions that govern how devices on a network exchange information.

The Scanner generates reports that contain the session data. There are three default report types available in The Scanner's Report Wizard: executive report, brief technical report, and full technical report. You can also create custom reports.

An HTML template that the Scanner uses to generate reports with information gathered from Scanner sessions. You can customize the templates according to your needs.

The Scanner uses a report wizard to generate reports. With the Report Wizard, you can choose which report components you need in your report and in which order you want them to appear.

Request For Comments. Document series used as the primary means for communicating information about the Internet. Some RFCs are designated by the IAB as Internet standards. Most RFCs document protocol specifications such as Telnet and FTP, but some are humorous or historical. RFCs are available online from numerous sources.

remote logon. Occurs when a user is already logged on to a user account and makes a network connection to another computer.

Network layer device that uses one or more metrics to determine the optimal path along which network traffic should be forwarded. Routers forward packets from one network to another based on network layer information. Occasionally called a gateway (although this definition of gateway is becoming increasingly outdated).

remote-procedure call. Technological foundation of client-server computing. RPCs are procedure calls that are built or specified by clients and executed on servers, with the results returned over the network to the clients. See also Client/Server Computing.

remote shell. Protocol that allows a user to execute commands on a remote system without having to log in to the system. For example, rsh can be used to remotely examine the status of a number of access servers without connecting to each communication server, executing the command, and then disconnecting from the communication server.

A scan is a nonintrusive analysis technique that identifies the open ports found on each live network device and collects the associated port banners found as each port is scanned. Each port banner is compared against a table of rules to identify the network device, its operating system, and all potential vulnerabilities.

A comprehensive corporate policy that outlines your plans for network security.

A symbol that depicts the constant need to follow five steps to maintain network security---create a corporate security policy; secure the network; monitor the network and respond to attacks; test existing security safeguards; and manage and improve corporate security.

A process that performs a specific system function and often provides an application programming interface (API) for other processes to call. Windows NT services are RPC-enabled, meaning that their API routines can be called from remote computers.

Simple Gateway Monitoring Protocol. Network management protocol that was considered for Internet standardization and later evolved into SNMP. Documented in RFC 1028. See also SNMP.

Simple Mail Transfer Protocol. SMTP is a member of the TCP/IP suite of protocols that governs the exchange of electronic mail between message transfer agents.

Simple Network Management Protocol. Network management protocol used almost exclusively in TCP/IP networks. SNMP provides a means to monitor and control network devices, and to manage configurations, statistics collection, performance, and security. See also SGMP and SNMP2.

SNMP Version 2. Version 2 of the popular network management protocol. SNMP2 supports centralized as well as distributed network management strategies, and includes improvements in the SMI, protocol operations, management architecture, and security. See also SNMP.

Security Posture Assessment. A comprehensive security analysis of large-scale, distributed client networks conducted by Cisco Systems engineers.

Transmission Control Protocol. Connection-oriented transport layer protocol that provides reliable full-duplex data transmission. TCP is part of the TCP/IP protocol stack.

Transmission Control Protocol/Internet Protocol. Common name for the suite of protocols developed by the U.S. DoD in the 1970s to support the construction of worldwide internetworks. TCP and IP are the two best-known protocols in the suite.

Standard terminal emulation protocol in the TCP/IP protocol stack. Telnet is used for remote terminal connection, enabling users to log in to remote systems and use resources as if they were connected to a local system. Telnet is defined in RFC 854.

Trivial File Transfer Protocol. Simplified version of FTP that allows files to be transferred from one computer to another over a network.

User Datagram Protocol. Connectionless transport layer protocol in the TCP/IP protocol stack. UDP is a simple protocol that exchanges datagrams without acknowledgments or guaranteed delivery, requiring that error processing and retransmission be handled by other protocols. UDP is defined in RFC 768.

Rules written by the user that are part of the vulnerability rules. These rules run after all other Scanner rules have run. They are useful for finding company-specific strings and for writing rules for new vulnerabilities between Scanner rules updates.

One or more attributes of a computer or a network that permit a subject to initiate patterns of misuse on that computer or network.

Rules used to flag a potential vulnerability, for example, a rule that identifies what the scanned host's operating system is, which ports it has open, and so forth.

The ability of the Scanner to expand or compress the Grid Browser up/down or right/left thus showing more or less data detail. This increase and decrease of data resolution within the grid is analogous to how a zoom lens provides greater or less magnification of an image.

Related Documentation

In addition to this guide, other printed and online documentation is available to assist you in learning about and using the Scanner.

• Cisco Secure Scanner CD-ROM Booklet---Contains installation and licensing information.

• Cisco Secure Scanner Help---The contents of this guide are available in online help format. You can access this online help by clicking Help on the About menu of Cisco Secure Scanner's main screen.

• Cisco Secure Scanner Version 2.0 Release Notes---A list of the enhancements from the last version of the Scanner and a list of the known limitations and caveats.

• Network Security Database---An HTML database that explains the nature and meaning of the vulnerabilities that the Scanner detects.

Document Conventions

This guide uses the following conventions:

• Scanner services, important terminology, and variable input for commands are shown in italics.

• Command names, buttons, and keywords are shown in boldface.

• Examples depict screen displays in screen font.

• Information you need to enter in examples is shown in boldface screen font.

• Variables for which you must supply a value are shown in italic screen font.

• Choosing a menu item is indicated by the following convention:

Click Show>Context on the Security menu.

Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data.

Tips Means the following are useful tips.

Cisco Connection Online

Cisco Connection Online (CCO) is Cisco Systems' primary, real-time support channel. Maintenance customers and partners can self-register on CCO to obtain additional information and services.

Available 24 hours a day, 7 days a week, CCO provides a wealth of standard and value-added services to Cisco's customers and business partners. CCO services include product information, product documentation, software updates, release notes, technical tips, the Bug Navigator, configuration notes, brochures, descriptions of service offerings, and download access to public and authorized files.

CCO serves a wide variety of users through two interfaces that are updated and enhanced simultaneously: a character-based version and a multimedia version that resides on the World Wide Web (WWW). The character-based CCO supports Zmodem, Kermit, Xmodem, FTP, and Internet e-mail, and it is excellent for quick access to information over lower bandwidths. The WWW version of CCO provides richly formatted documents with photographs, figures, graphics, and video, as well as hyperlinks to related information.

You can access CCO in the following ways:

• WWW:  http://www.cisco.com

• WWW:  http://www-europe.cisco.com

• WWW:  http://www-china.cisco.com

• Telnet:  cco.cisco.com

• Modem:  From North America, 408 526-8070; from Europe, 33 1 64 46 40 82. Use the following terminal settings: VT100 emulation; databits: 8; parity: none; stop bits: 1; and connection rates up to 28.8 kbps.

For a copy of CCO's Frequently Asked Questions (FAQ), contact cco-help@cisco.com. For additional information, contact cco-team@cisco.com.

Documentation CD-ROM

Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM, a member of the Cisco Connection Family, is updated monthly. Therefore, it might be more current than printed documentation. To order additional copies of the Documentation CD-ROM, contact your local sales representative or call customer service. The CD-ROM package is available as a single package or as an annual subscription. You can also access Cisco documentation on the World Wide Web at http://www.cisco.com, http://www-china.cisco.com, or
http://www-europe.cisco.com.

If you are reading Cisco product documentation on the World Wide Web, you can submit comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco. We appreciate your comments.

Posted: Thu Jun 29 14:06:22 PDT 2000
Copyright 1989 - 2000©Cisco Systems Inc.