Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was trying to test out my friend's computer (with agreement) by using nmap remotely. But the result I got seems kinda awkward to me. It only showed 1900 as tcpwrapper and all other ports were no responded. And OS detection was 3Com router not the machine I thought.

Is it because it blocks nmap scanning at router? I tested same network and other machines were revealed with various ports/services.

Any idea how to interpret this result and do some further testing on this machine?

share|improve this question

2 Answers 2

up vote 7 down vote accepted

She's probably using NAT.

Proper, publicly routable IP addresses are scarce and expensive. So, in a small home or business network, like most of us have these days, it makes sense for the ISP to only provide you with a single public routable IP address, and use some clever trickery in the router to allow all the devices in the network to share it.

While NAT lets home users do 99% of what they need to, there are many limits on what you can do when one is in place, and you're seeing one of them.

(To forestall the comments: obviously, from a security perspective, the fact that you can't easily do port scans from outside is a benefit, rather than a limitation!)

share|improve this answer
    
totally - without knowing more about the network setup, this is likely what's happened. –  schroeder Apr 30 '12 at 14:32
    
I totally agree about NAT. But when how could you explain other machines which are under same network were scannable. I believe most of home network is using NAT by default. –  REALFREE May 1 '12 at 2:13
    
NAT with host mappings, probably. But if your friend has multiple public/routable IP addresses then their network is far more sophisticated than what you get "out-of-the-box" from a consumer ISP and we're not going to be able to give a definite answer without a lot more information. For all we know it's honeypotted... –  Graham Hill May 1 '12 at 10:32

How to do further testing:

The end result is that you have to get the router out of the way. Your friend would need to allow traffic through the router directly to the computer (port forwarding, for example), which would expose her computer to every attack on the internet (assuming that her router has only very simple firewall rules available).

Or, you would have to initiate the scan from inside her network. This can be done by having another computer inside her network that is accessible from the outside (remote desktop, teamviewer, PC Anywhere (normal remote access warnings apply)).

If you just want practice, you could set up a virtual network on your computer (virtualbox, or vmware) and run scans from that, but it won't be your friend's computer.

share|improve this answer
    
I was thinking if there is a way to get into router setting or bypass so that I can reach to the machine.. –  REALFREE May 1 '12 at 2:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.