Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently used nmap online to test my firewall security on the WAN port. I purposely did some port forwarding but received inconsistent results. I opened ports 6881 to 6889 on the firewall and did 2 scans. In Scan #1, the range was set from port 1 through 16382. The result came back as all ports filtered. I found the result strange so I did Scan #2 with only ports 6880 through 6890 selected. This time it did show results on that range. Any idea on why the scan results would be different?

Scan #1

Starting Nmap 6.25 ( http://nmap.org ) at 2013-03-21 07:11 Central Europe Standard Time
Nmap scan report for xx-xxx-xxx-236.dsl.teksavvy.com (xx.xxx.xxx.236)
Host is up.
All 16382 scanned ports on xx-xxx-xxx-236.dsl.teksavvy.com (xx.xxx.xxx.236) are filtered
Nmap done: 1 IP address (1 host up) scanned in 1717.66 seconds

Scan #2

Starting Nmap 6.25 ( http://nmap.org ) at 2013-03-21 08:08 Central Europe Standard Time
Nmap scan report for xx-xxx-xxx-236.dsl.teksavvy.com (xx.xxx.xxx.236)
Host is up.
PORT STATE SERVICE
6880/tcp filtered unknown
6881/tcp filtered bittorrent-tracker
6882/tcp filtered unknown
6883/tcp filtered unknown
6884/tcp filtered unknown
6885/tcp filtered unknown
6886/tcp filtered unknown
6887/tcp filtered unknown
6888/tcp filtered muse
6889/tcp filtered unknown
6890/tcp filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 3.31 seconds
share|improve this question
1  
Can you state exactly what flags you used? –  Terry Chia Mar 21 '13 at 13:21
    
Are you cooking Crystal Meth with this server? –  Lucas Kauffman Mar 21 '13 at 14:19

3 Answers 3

The results are consistent. In both cases you're getting that all the scanned ports are filtered. The Nmap setup at domain-tools seems to be configured to not show the state of more than 25 consecutive ports separately.

In the first case you specified 16382 ports and they all turned out to be filtered, so Nmap won't bother printing all 16382 ports, it will just tell you they're all filtered.

In the second case you specified only 10 ports, they all turned out to be filtered, but this time since they're not so many, Nmap printed them all.

share|improve this answer

As far as I can see, the results are actually identical. The difference is that in the second scan, you scan less ports, so nmap displays the result for each port.

But the state for each port in both scans are "filtered".

The output of the service-field, depends on the contents of /etc/services. If a port is listed with a service, you will see that service in the service column, otherwise output will be unknown.

share|improve this answer

As others have pointed out, the results are not inconsistent with each other. Nmap simply rolls up large numbers of similar results (in this case, filtered ports) to avoid excessive output.

There are two possible reasons you cannot see your forwarded ports as open. First, though the ports are allowed through your firewall, they may not be open on the host. This is not likely to be the case, since they would then show as "closed" instead of "filtered." The second reason, and much more likely, is that many ISPs block traffic on ports 6881-6889, because these are or were used by default for BitTorrent traffic. ISPs dislike BitTorrent because it is a peer-to-peer file sharing protocol, often causing excessive bandwidth use and targeted by financial and legal pressure from copyright holders such as the RIAA and MPAA.

Other ports that ISPs often filter include 80 (to force businesses to pay for business-class service), 25 (to prevent spam), and 445 (to prevent exploitation of Windows computers).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.