Nmap scanning single port too fast? Shows as filtered?

Question

I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with port 25, and suddenly it is showing filtered instead of open.

I start tinkering to see if I can try to troubleshoot this problem. First I try running the same scan again to see if maybe I got the wrong IP. Same list, but I chose the next result. Try the new IP with port 25, shows filtered.

Now I'm trying to figure out how I can get it to show open on that one IP. I scan the same single IP with no specified port, and port 25, along with others show as open. Scan the same IP with just port 25, and it says filtered. I add one more port from the previous scan, and port 25 and the other port show as open.

It confuses me why running nmap -p 25 [IP] gives me 25/tcp filtered smtp yet running the same command with at least two ports gets me a positive result.

Am I missing something? Can someone explain what I'm doing wrong?

I did write in the title that maybe the scan was too fast, because I had already tried the -T flag.

The commands that I used in the process of troubleshooting and their result:

nmap 10.11.1.227
...
PORT     STATE SERVICE
21/tcp   open  ftp
25/tcp   open  smtp
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
443/tcp  open  https
445/tcp  open  microsoft-ds
1025/tcp open  NFS-or-IIS
1026/tcp open  LSA-or-nterm
1028/tcp open  unknown
3372/tcp open  msdtc
5800/tcp open  vnc-http
5900/tcp open  vnc

I tried one port with scripts (which failed, so I tried one port no scripts):

nmap -p 25 10.11.1.227
...
PORT   STATE    SERVICE
25/tcp filtered smtp

I tried two ports that I know are open:

nmap -p 25,5900 10.11.1.227
...
PORT     STATE SERVICE
25/tcp   open  smtp  
5900/tcp open  vnc

At that point I think about whether probing one port is too fast and decide to try -T4, then -T3, and then finally:

nmap -p 25 -T2 10.11.1.227

Gives me a positive result. So problem fixed right? Not in my head. I want to know if I'm doing something wrong, or if this is unavoidable, and I just have to accept the solution as is. And if that is the case, and someone knows why, I would also like to know why that is the case.

Answer 1

It does indeed seem like a timing issue. nmap might be timing out on the single scan and reporting the results as filtered. With the other ports or systems included in the scan, the timeout might be different.

To find out what is going on, you will have to run a packet capture. Wireshark is the de facto tool for this. Run nmap -p 25 10.11.1.227 and capture the results, then run nmap -p 25,5900 10.11.1.227 and capture the results. Compare the differences. Chances are that the differences are obvious.

In general, when things like this happen, always go to the packet traces to see what's going on. You will learn a lot.

Answer 2

Use -Pn

-Pn: Treat all hosts as online -- skip host discovery

nmap -Pn -p 25 [IP address]

Equally, -T<0-5> allows you to set timing.

-T<0-5>: Set timing template (higher is faster)

nmap -T4 -p 25 [IP address]

Nmap has a reference guide Timing and Performance.

See, Why are some ports reported by nmap filtered and not the others?

Answer 3

Filtered means that port is secured by a firewall installed by the company. You cannot send or receive any information through that port as you are an outsider. Do some research on port filtering. That's actually a security action to avoid unauthorized access to their company network. You can evade the firewall with these commands in nmap. Good Luck

https://www.stationx.net/nmap-cheat-sheet/ ( See the firewall evasion section at the bottom )

https://youtu.be/goTeHX0-_b0