Linux – Command or utility to measure the amount of traffic generated by an nmap scan

bandwidthlinuxnetworkingnmap

First, just a bit of background:

My ISP has decided to block all inbound connections (from their customers' perspective) which effectively means that I can no longer host anything on my connection (FTP, HTTP etc.) or use any of a number of programs that require one or more listening ports to be specified for use by inbound connections (SSH, RDP, uTorrent, etc. etc.)

Apparently they recently "suffered" a port scan attack on an entire IP range that has been allocated for use by their subscribers and their reasoning now (as a metered-bandwidth ISP) is that allowing inbound connections again will generate too much additional, unsolicited traffic which the majority of their subscribers will not be willing to pay for (or even understand where it's coming from).

I disagree in that, in the grand scheme of things, I don't think a bunch of SYN packets and the resulting NACK (?) packets as sent back from a host-based firewall (for example) will end up causing THAT much additional traffic.

My question is whether there is any way in which I can measure the amount of bandwidth that such a port scan will typically generate if I were to scan all the ports on my own machine? nmap is ideal for this, but I'm not sure how one would measure the total bandwidth (including the 'reject' packets sent back from the target machine, if any).

I am fairly proficient with the bash shell and know my way around Linux. Any help would be greatly appreciated!

Best Answer

You can use iptables(add allow rules)

Scanning host 8.8.8.8:

# iptables -I INPUT 1 -s 8.8.8.8 -j ACCEPT
# iptables -I OUTPUT 1 -d 8.8.8.8 -j ACCEPT
# iptables -Z && nmap -O 8.8.8.8
# iptables -vn -L
Chain INPUT (policy ACCEPT 273 packets, 17374 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    8   320 ACCEPT     all  --  *      *       8.8.8.8              0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 140 packets, 13386 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2043 94224 ACCEPT     all  --  *      *       0.0.0.0/0            8.8.8.8
Related Topic