• Stream Control Transmission Protocol

SCTP Scanning Techniques Guide

Overview of SCTP

Stream Control Transmission Protocol (SCTP) is a reliable, message-oriented transport layer protocol that combines characteristics of both TCP and UDP, offering a robust alternative for specialized networking applications.

Core Features

• Reliability: Provides guaranteed delivery like TCP
• Message-Oriented: Maintains message boundaries like UDP
• Multi-homing: Supports multiple IP addresses per endpoint for redundancy
• Multi-streaming: Allows multiple independent streams within a single association

Common Applications

• Voice over IP (VOIP)
• IP Telephony
• SS7/SIGTRAN Services (Signaling System 7/SIGnaling TRANsport)
• Telecommunications signaling

SCTP Association: Four-Way Handshake

Unlike TCP's three-way handshake, SCTP establishes connections using a four-way handshake mechanism:

Client                          Server
  |                               |
  |-------- INIT ---------------→ |  (1) Initiate connection
  |                               |
  |←------- INIT-ACK ------------ |  (2) Acknowledge and send cookie
  |                               |
  |-------- COOKIE-ECHO --------→ |  (3) Return cookie for verification
  |                               |
  |←------- COOKIE-ACK ---------- |  (4) Confirm association established
  |                               |

Handshake Steps:

1. INIT: Client sends initialization chunk
2. INIT-ACK: Server responds with acknowledgment
3. COOKIE-ECHO: Client echoes the cookie
4. COOKIE-ACK: Server confirms completed association

SCTP Scanning Techniques

Attackers and security professionals leverage SCTP's handshake mechanism to perform reconnaissance and port scanning on target systems.

1. SCTP INIT Scan (-sY)

The SCTP equivalent of TCP SYN scanning, offering stealth and speed.

Operational Characteristics

• Stealth: Creates half-open connections by not completing the full association
• Speed: Can scan thousands of ports per second on fast, unfiltered networks
• Detection Avoidance: Unobtrusive and difficult to log
• Clear Results: Reliably differentiates between port states

Scan Process

Attacker                        Target
  |                               |
  |-------- INIT ---------------→ |
  |                               |
  |←------ Response ------------- |

Port State Interpretation

Nmap/Zenmap Command

nmap -sY <target>

Use Cases

• Discovering SCTP services (VoIP, telephony systems)
• Fast reconnaissance on large network ranges
• Initial enumeration before advanced scanning

2. SCTP COOKIE ECHO Scan (-sZ)

An advanced, stealthier scanning technique that exploits the COOKIE-ECHO phase of the handshake.

Operational Characteristics

• Advanced Stealth: Bypasses non-stateful firewall rules
• Firewall Evasion: COOKIE-ECHO chunks typically not filtered like INIT chunks
• Detection: Only advanced IDS can detect this scan type
• Less Conspicuous: More difficult to identify than INIT scans

Scan Process

Attacker                        Target
  |                               |
  |------- COOKIE-ECHO ---------→ |
  |                               |
  |←------ Response (or none) --- |

Port State Interpretation

Result Ambiguity

Critical Limitation: This scan cannot clearly differentiate between OPEN and FILTERED ports, often resulting in:

• Output state: open|filtered
• Both open and filtered ports produce no response
• Requires secondary verification techniques

Nmap/Zenmap Command

nmap -sZ <target>

Use Cases

• Evading stateless firewalls that block INIT packets
• Testing firewall configurations for SCTP filtering
• Advanced reconnaissance when INIT scans are detected/blocked
• Secondary verification after INIT scans

Comparison: INIT vs COOKIE ECHO Scans

Detection and Defense

For Network Defenders

Detecting SCTP Scans:

1. Monitor SCTP traffic patterns:

   • Unusual INIT chunks to multiple ports
   • COOKIE-ECHO chunks without prior association

2. Deploy stateful firewalls:

   • Track complete SCTP association state
   • Block invalid COOKIE-ECHO attempts

3. Implement advanced IDS:

   • Signature-based detection for scan patterns
   • Anomaly detection for unusual SCTP behavior

4. Log SCTP connection attempts:

   • Record incomplete associations
   • Alert on rapid port scanning patterns

Hardening Measures:

• Disable SCTP on systems that don't require it
• Filter SCTP traffic at network boundaries
• Implement rate limiting on SCTP connection attempts
• Use application-layer filtering for legitimate SCTP services

Security Implications

For Penetration Testers

• Always obtain authorization before scanning
• Use INIT scans for initial enumeration
• Deploy COOKIE ECHO scans when facing firewall restrictions
• Combine with other reconnaissance techniques for comprehensive assessment

For Attackers (Understanding Threats)

SCTP scanning enables:

• Discovery of telecommunications infrastructure
• Identification of VoIP systems
• Mapping of signaling services
• Reconnaissance for targeted attacks on telephony networks

Summary

SCTP scanning techniques exploit the protocol's four-way handshake mechanism to identify services and assess security postures:

• INIT Scan: Fast, reliable, detectable by standard security tools
• COOKIE ECHO Scan: Stealthy, firewall-evading, limited result clarity

Both techniques require specialized tools (Nmap/Zenmap) and are primarily used in telecommunications and VoIP environments. Understanding these methods is essential for both offensive security assessments and defensive network hardening.