2

I'm working on a challenge and I notice this odd output for a full port scan?

abc@desktop:~$ nmap -T5 -p- -sV x.x.x.x -PN

Interesting ports on x.x.x.x:
Not shown: 65533 filtered ports
PORT      STATE  SERVICE       VERSION
3389/tcp  open   microsoft-rdp Microsoft Terminal Service
11111/tcp closed unknown
Service Info: OS: Windows

I'm used to NMAP only displaying open ports. In this case the vast majority of ports were closed but NMAP explicitely stated port 60000 is closed.

What does an explicitely closed port mean?

4

You are performing a SYN scan or TCP connect scan (depending on your account permissions). With those scan types, you can receive the following port states based on the results of the TCP handshake:

  • open: An ACK packet was received, indicating that the connection was accepted.
  • closed: A RST packet was received from the host or firewall, rejecting the connection.
  • filtered: No response was received when attempting to connect to this port.

It is also worth noting that Nmap utilizes half-open scanning in the SYN scan mode because it never completes the TCP handshake. The idea is that this is more stealthy because logs often record when a connection is actually established.

| improve this answer | |
  • Regarding the logs on a full three way handshake: This used to be the case, but this is no longer valid. Even if a three way handshake is not performed, it will show up in log files. – Jeroen Oct 31 '15 at 6:48
  • @Jeroen-ITNerdbox Do you have information about the prevalence of that behavior? I can confirm that a SYN scan is not passed on to a listening program on my Linux system whereas the connect scan is. – Austin Hartzheim Oct 31 '15 at 16:22
  • "Modern firewalls and Intrusion Detection Systems can detect SYN scans, but in combination with other features of Nmap, it is possible to create a virtually undetectable SYN scan by altering timing and other options." Source: nmap.org/bennieston-tutorial - So with just a SYN scan (-sS) You'll show up in logs. I am uncertain about iptables (assuming you're using that to test it), per your statement apparently it does not. – Jeroen Oct 31 '15 at 16:45
  • 1
    @Jeroen-ITNerdbox That tutorial is way out of date, but that part is valid. I wrote more on the evasion/detection angle recently: blog.bonsaiviking.com/2015/07/… – bonsaiviking Oct 31 '15 at 19:57
  • 1
    Filtered can also be a result of certain ICMP responses like Destination Unreachable code 9, 10, or 13. – bonsaiviking Oct 31 '15 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.