Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside?

Also, does blocking nmap on a network provide any security?

EDIT:

If I try:

nmap scanme.nmap.org - I get: 1 IP address (0 hosts up) scanned in 0.50 seconds

nmap -sT -P0 -p 80 scanme.nmap.org - works

nmap -sT -p 80 scanme.nmap.org - doesn't work

Also, only -sT (TCP connect works), SYN scanning (-Ss) doesn't work.Seems like this could be some type of egress filtering.

share|improve this question
6  
Please describe the "blocking" behavior. What Nmap command did you run, what was the result, and what did you expect? Most likely they are not "blocking nmap" explicitly, but doing something else that is affecting your scan. –  bonsaiviking Mar 25 '13 at 19:27
    
Without knowing what leads you to refer to it as blocked, this isn't answerable. Please provide more details about what you saw, then flag it for re-opening. –  Jeff Ferland Mar 25 '13 at 19:52
    
That is the expected behavior. Your provider is not blocking anything. –  bonsaiviking Mar 25 '13 at 20:15
add comment

5 Answers

up vote 3 down vote accepted

nmap scanme.nmap.org - I get: 1 IP address (0 hosts up) scanned in 0.50 seconds

It seems they block SYN TCP requests to uncommon ports. Is there a workaround for this?

It sounds to me like they're blocking ping instead, and by default nmap will only start a scan on a host that responds to ping. Try nmap -sT -P0 -p 80 to see how it reacts since we know 80 is open. Then try nmap -sT -p 80 and see if it reacts differently.

This might be happening at your edge router rather than your ISP. Some of them don't respond to ping by default.

share|improve this answer
    
Thanks for the suggestion Jeff. nmap -sT -P0 -p 80 shows host is up. nmap -sT -p 80 shows host is down. ping however, works correctly. –  marcwho Mar 25 '13 at 20:40
    
Also SYN scanning doesn't work (-sS), only TCP connect scans work, -sT –  marcwho Mar 25 '13 at 20:53
    
In a strange way, that's "unpossible", because a SYN scan relies on the returning ACK, and you can't have a full connect() without having the returning ACK for that too. –  Jeff Ferland Mar 25 '13 at 21:47
add comment

If your provider filtering device (ids,end-point protection) has detected some kind of malicious traffic generated from your home-network; that rule (blocking) of namp may be linked in that case. Or sometimes these devices have auto rules to block in case of recon attacks. The traffic from home-network is more of a client-> internet requests ; devices that just analyzes behavior get cautious as they see now inbound traffic generated towards the home-network. Anyhow, you should take this matter with the provider.

As to scan the home-network have you tried an online solution?

  1. http://nmap.online-domain-tools.com/
  2. http://www.seomastering.com/port-scanner.php

If the results still fail it means its not just you; its just the signature that get caught by the filtering device and gets blocked.

share|improve this answer
add comment

Blocking nmap is a very concerning. Whoever put this policy into play doesn't have a functional understanding of security because they are making it difficult for you to test your own firewall (doah!). You can probably build nmap from source in your home directory, or you can use netcat (which is installed by default on many *nix distributions):

nc -z google.com 0-65535
share|improve this answer
    
It seems that netcat just hangs there. If I try any ip other than local, I get no reply. I am able to ping out, but can't port scan. I have checked my iptables rules and OUTPUT is allowed. Could this be their network blocking all port scans, how is this possible? –  marcwho Mar 25 '13 at 17:29
1  
@marcwho netcat is reallllly slow compared to nmap. You should leave it for a few hours. –  Rook Mar 25 '13 at 17:33
    
Sounds like they may have implemented Egress Filtering. –  Joe Gatt Mar 25 '13 at 17:42
    
@Joe Gatt when I try: nmap -Pn -p 1-65535 scanme.nmap.org, I get: Nmap done: 1 IP address (0 hosts up) scanned in 0.48 seconds. However, I am able to ping scanme.nmap.org. Could they be blocking certain TCP SYN requests? –  marcwho Mar 25 '13 at 19:48
    
Ping or ICMP is a different protocol than TCP. It is entirely possible that they are using egress filtering to restrict outbound TCP traffic while allowing ICMP. –  Joe Gatt Mar 25 '13 at 23:53
add comment

Try changing the source port nmap uses?

nmap -g 80 <target>

You might find that the firewall allows the scans on other ports.

share|improve this answer
add comment

Are you actually able to make any outgoing TCP-connections? From what you're writing it seems like they're blocking outgoing SYN-packets.

Can you make outgoing connections on port 80 or 443? They might filter "uncommon" ports. Blocking outgoing packets doesn't really provide much security, if they allow port 80 or 443. However, it might create some noise if customers run outgoing nmap-scans on various targets.

In addition to nc, you can also try good old telnet:

$ telnet your-ip [port]

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.