I'm trying to find out what nmap-commands crash an embedded-system. In the process I can see behaviour that I don't understand:
On the system port 80 is open and 79 is closed.
nmap -p 79-80 -T5 -A-> system crashes
nmap -p 80 -T5 -A-> no crash and normal response
It doesn't matter which closed ports I add or remove from the range around the open port 80. As soon as I scan any port other than 80, the system crashes.
I'd be happy to hear some ideas why this could happen or some way to find out.
EDIT: The reason for this seems to be the timing-option -T5.
nmap -p 79-80 -T5 -A -> 79/tcp closed finger 80/tcp open http? 81/tcp closed
nmap -p 80 -T5 -A -> 80/tcp filtered http
nmap -p 80 -A -> 80/tcp open http? -> also crashes as expected!