Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a host that is NAT'ed and I have opened a single port in my router so the host is reachable by the external world. I tested if it was reachable by running a service and connecting to it externally.

I stopped the service, but the port is still open on the router. When I run nmap from an external server, it doesn't show that port and ends.

This is how I ran nmap from the external server:

sudo nmap -n -PN -sA x.x.x.x

and it returns:

Nmap done: 1 IP address (0 hosts up) scanned in 0.49 seconds

As far as I know my router blocks icmp requests. So how do I make nmap show unfiltered ports ?

share|improve this question
What IP is x.x.x.x, your NAT'ed host or your router? – schroeder Aug 6 '13 at 20:15
up vote 0 down vote accepted

In order to identify ports being redirected to an internal machine, although the internal machine has not got any service in that port, you can use some type of "firewalking" technique.

This technique basically consists on sending packets with different TTL values in order to try to discover when the packet you sent is "stopped".

You have a NSE script for trying firewalk with NMAP, the original firewalk tool or deeper explanations about firewalking

share|improve this answer

I have stopped the service, but the port is still open.

Your port is "open" on the router, which only passes traffic on to its destination. If there is nothing listening at the destination (the service is stopped), it is a closed port for all intents and purposes. It's just not a firewalled port.

share|improve this answer

By default nmap only scans the most commonly used ports. If your open port is not a common port number, add "-p1-65535" to your command line to scan all ports.

sudo nmap -Pn -sS -p1-65535 hostname

On some NAT/routers, if the port is forwarded, but the service is not running on the destination host, it (port forward) cannot be detected by a port scan (FILTERED). But in most cases it should show up as CLOSED.

share|improve this answer
It keeps saying host is down, although -Pn flag is applied and doesn't produce any output. I started the service and it still refuses to scan because it thinks host is down. I think it is a crap way to assume host is down based on icmp response. – Naai Sekar Aug 4 '13 at 7:53

The appropriate nmap command will be

nmap -n -Pn -sS x.x.x.x

The -PN flag doesn't exist for nmap. I think you have made a typo.

There is also no reason for you to use the -sA scan type. From the man page,

This scan is different than the others discussed so far in that it never determines open (or even open|filtered) ports. It is used to map out firewall rulesets, determining whether they are stateful or not and which ports are filtered.

Instead, you should use the -sS scan type.

share|improve this answer
Nope it still doesn't work for me. This is how i ran it. $ sudo nmap -n -Pn -sS x.x.x.x Starting Nmap 5.51 ( ) at Nmap done: 1 IP address (0 hosts up) scanned in 0.48 seconds – Naai Sekar Aug 4 '13 at 4:19
@ashwin I have re-read your question. You have nothing listening on the port..... Therefore nmap can't tell if your host is up..... – Terry Chia Aug 4 '13 at 4:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.