2

I'm working on a challenge and I notice this odd output for a full port scan?

abc@desktop:~$ nmap -T5 -p- -sV x.x.x.x -PN

Interesting ports on x.x.x.x:
Not shown: 65533 filtered ports
PORT      STATE  SERVICE       VERSION
3389/tcp  open   microsoft-rdp Microsoft Terminal Service
11111/tcp closed unknown
Service Info: OS: Windows

I'm used to NMAP only displaying open ports. In this case the vast majority of ports were closed but NMAP explicitely stated port 60000 is closed.

What does an explicitely closed port mean?

1

1 Answer 1

4

You are performing a SYN scan or TCP connect scan (depending on your account permissions). With those scan types, you can receive the following port states based on the results of the TCP handshake:

  • open: An ACK packet was received, indicating that the connection was accepted.
  • closed: A RST packet was received from the host or firewall, rejecting the connection.
  • filtered: No response was received when attempting to connect to this port.

It is also worth noting that Nmap utilizes half-open scanning in the SYN scan mode because it never completes the TCP handshake. The idea is that this is more stealthy because logs often record when a connection is actually established.

7
  • Regarding the logs on a full three way handshake: This used to be the case, but this is no longer valid. Even if a three way handshake is not performed, it will show up in log files.
    – Jeroen
    Oct 31, 2015 at 6:48
  • @Jeroen-ITNerdbox Do you have information about the prevalence of that behavior? I can confirm that a SYN scan is not passed on to a listening program on my Linux system whereas the connect scan is. Oct 31, 2015 at 16:22
  • "Modern firewalls and Intrusion Detection Systems can detect SYN scans, but in combination with other features of Nmap, it is possible to create a virtually undetectable SYN scan by altering timing and other options." Source: nmap.org/bennieston-tutorial - So with just a SYN scan (-sS) You'll show up in logs. I am uncertain about iptables (assuming you're using that to test it), per your statement apparently it does not.
    – Jeroen
    Oct 31, 2015 at 16:45
  • 1
    @Jeroen-ITNerdbox That tutorial is way out of date, but that part is valid. I wrote more on the evasion/detection angle recently: blog.bonsaiviking.com/2015/07/… Oct 31, 2015 at 19:57
  • 1
    Filtered can also be a result of certain ICMP responses like Destination Unreachable code 9, 10, or 13. Oct 31, 2015 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.