Nmap reporting the status of a port as both opened and closed

Question

If I do not define any range (or if the range is large like a hundreds of ports), Nmap is returning ports as opened. However, if I put a smaller range or just scan a specific port, it says it's closed.

For example:

nmap -sV
1110/tcp  open     nfsd-status?
1111/tcp  open     lmsocialserver?
1112/tcp  open     msql?
1113/tcp  open     ltp-deepspace?
1117/tcp  open     ardus-mtrns?
1119/tcp  open     bnetgame?


nmap -sV -p 1110-1120
1110/tcp closed nfsd-status
1111/tcp closed lmsocialserver
1112/tcp closed msql
1113/tcp closed ltp-deepspace
1114/tcp closed mini-sql
1115/tcp closed unknown
1116/tcp closed ardus-cntl
1117/tcp closed ardus-mtrns
1118/tcp closed sacred
1119/tcp closed bnetgame
1120/tcp closed unknown

Answer 1

You are not providing much information about the target host. Is it a host you own and configured yourself? Or is this a scan of a 3rd-party host?

Assuming it is a 3rd-party host, I would suggest that the reason you observe this sort of behavior is because this host is behind some sort of network Intrusion Prevetion System or stateful firewall that implements Port Knocking.

When you perform nmap scans without explicitly specifying the port range, nmap scans by default the most common 1000 ports. During this scan, nmap accidentally* connects to the right sequence of ports in order to trigger a "knock", which results in dynamic modification of the firewall rules in order to allow connections to the ports you mentioned.

When you explicitly specify the port range, the "secret handshake" of connecting to a specific port sequence never happens and the firewall keeps dropping any traffic destined for those ports.

Given the fact that you observe such behavior both with top 1000 common ports and with other arbitrary large ranges, I would assume that the "knock" is a collection and not a sequence of ports -in other words, the order of connections to those ports does not matter.

[*] This might not be entirely accidental if this host is part of some network security challenge or a honeypot. It is highly unlikely for someone to roll-out such mechanism without bothering to test it with mainstream network/security scanning tools.

Answer 2

One possibility is that you triggered an IDS or other active protection system. Nmap's default scan has a fairly distinctive signature, and if the network you're scanning spots it, you may have been blocked at the firewall between the first and second scans (or even during the later parts of the first scan).