is open. This is different from a normal three-way TCPhandshake, where the client will send a SYN packet and then send anACK back to the server once it has received the initial server ACK.Attackers typically use this option to avoid having their scanslogged on the remote machine. nmap -sS -O rigelStarting nmap V. 3.00 ( www.insecure.org/nmap/ )Interesting ports on rigel.nnc (192.168.0.61):(The 1578 ports scanned but not shown below are in state: filtered)Port State Service7/tcp open echo 9/tcp open discard 13/tcp open daytime 19/tcp open chargen 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 79/tcp open finger 111/tcp open sunrpc 512/tcp open exec 513/tcp open login 514/tcp open shell 587/tcp open submission 7100/tcp open font-service 32771/tcp open sometimes-rpc5 32772/tcp open sometimes-rpc7 32773/tcp open sometimes-rpc9 32774/tcp open sometimes-rpc11 32777/tcp open sometimes-rpc17 Remote operating system guess: Solaris 9 Beta through Release on SPARCUptime 44.051 days (since Sat Nov 1 16:41:50 2003)Nmap run completed -- 1 IP address (1 host up) scanned in 166 secondsWith OS detection enabled, nmap has confirmed that the OS is Solaris,but now you also know that it's probably Version 9 running on a SPARCprocessor. One powerful feature that can be used to help keep track of yournetwork is nmap's XML output capabilities. This is activated by usingthe -oX command-line switch, like this: nmap -sS -O -oX scandata.xml rigelThis is especially useful when scanning a range of IP addresses oryour whole network, because you can put all the information gatheredfrom the scan into a single XML file that can be parsed and insertedinto a database. Here's what an XML entry for an open port lookslike: nmap is a powerful tool. By using its XML output capabilities, alittle bit of scripting, and a database, you can create an even morepowerful tool that can monitor your network for unauthorized servicesand machines. Backup yourbootsectorDifficulty Expert Application Shell Messing with bootloaders, dual-booting and various other scaryprocesses can leave you with a messed up bootsector. Why not create abackup of it while you can: dd if=/dev/hda of=bootsector.img bs=512 count=1Obviously you should change the device to reflect your boot drive (itmay be sda for SCSI). Also, be very careful not to get things thewrong way around - you can easily damage your drive! To restore use: dd if=bootsector.img of=/dev/hda Protect log filesDifficulty: Expert Application: Various During an intrusion, an attacker will more than likely leavetelltale signs of his actions in various system logs: a valuableaudit trail that should be protected. Without reliable logs, it canbe very difficult to figure out how the attacker got in, or where theattack came from. This info is crucial in analysing the incident andthen responding to it by contacting the appropriate parties involved.But, if the break-in is successful, what's to stop him from removingthe traces of his misbehaviour? This is where file attributes come in to save the day (or at leastmake it a little better). Both Linux and the BSDs have the ability toassign extra attributes to files and directories. This is differentfrom the standard Unix permissions scheme in that the attributes seton a file