Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have different results as of my open TCP ports. When using nmap -sS, I get some 5 usual open ports, but when using osx built-in tool as stroke, I get those 5 ports plus 5 extra ports. How can it come ?

first nmap -sS

Starting Nmap 6.25 ( ) at 2013-07-03 12:00 CEST
Nmap scan report for localhost (
Host is up (0.00012s latency).
Not shown: 995 closed ports
80/tcp   open  http
88/tcp   open  kerberos-sec
548/tcp  open  afp
631/tcp  open  ipp
8888/tcp open  sun-answerbook

and ./stroke 0 6000 gives

Open TCP Port:  80          http
     Open TCP Port:     88          kerberos
     Open TCP Port:     548         afpovertcp
     Open TCP Port:     631         ipp
     Open TCP Port:     4370
     Open TCP Port:     4371
     Open TCP Port:     4380
     Open TCP Port:     4381
     Open TCP Port:     5037
share|improve this question
It would be useful to show the output of both programs and the options you used. – Lucas Kauffman Jul 3 '13 at 10:31
@LucasKauffman see update – Newben Jul 3 '13 at 10:36
up vote 13 down vote accepted

My guess is that you aren't seeing those open ports is because of the default behavior of nmap to only scan the 1.000 most commonly used ports.

If you want to cover all ports you need to explicitly state that you want to scan all ports with the -p parameter. So say I want to scan from port 1 until 5037:

nmap -sS -p1-5037

To view which process is running on what port:

sudo lsof -i -P | grep -i "listen"
share|improve this answer
thank you for your response ! So now, how can it be that those ports are open, how can I know which applications is using those ports ? – Newben Jul 3 '13 at 10:47
updated my answer, you can just lookup what process is using that particular PID – Lucas Kauffman Jul 3 '13 at 10:51
sorry when runnig your command I get lsof: unacceptable port specification in: -i 4TCP: lsof 4.85 – Newben Jul 3 '13 at 10:57
did you change $port to the given port? I'll update my question – Lucas Kauffman Jul 3 '13 at 11:04
nmap is used for scanning open ports on IPs, so you can use it on remote machines. lsof is actually a tool which looks in the operating system and sees what processes are using what ports. – Lucas Kauffman Jul 3 '13 at 11:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.