How to scan for ports opened by TCP/UDP sockets with nmap or any other tool?

Question

I'm new to nmap and I've been digging with it lately to scan some devices on the current LAN for ports opened by socket programs which are running.

First I ran a simple UDP server on my machine on port 55555 and I scanned the localhost with these options:

nmap -sT -sU -d -d localhost

(I know -sT is useless for this case but I tried it in all my trials)

It shows port 55555 as closed. I terminated the server process and still the port is closed.

I'm not sure if I can scan for TCP/UDP socket ports by nmap. Is it possible to do it with nmap or some other tool?

Answer 1

I believe you should understand TCP/IP fully, how interconnections are made, filtered/blocked fully. For starters -sT (TCP connect) is the most reliable type of connection since it completes a full handshake. NMAP output varies based on what you are scanning, whether or not the targets have filtering/firewalling. There is a simpler way of seeing what ports are opened on your systems. It's called netstat. By logging into any one of your machines, you could just run a netstat on those machines to see what is established, and or listening. This will give you a more accurate picture of the application using a port. (e.g., if for some reason I assign port 21 to my http server, you will see it versus assuming I am running FTP).

But back to your question on seeing output. There are two views here (being you typed localhost)... What YOU will see, versus what someone outside of the LAN will see. If you're on a Linux/BSD system, you don't need to run nmap. You could use LSOF:

$ sudo lsof -i -n | awk '{print $1"\t"$8"\t"$9}'

This will show you all network based sockets in use. But if you STILL want to use nmap, you need to understand how nmap works by default (e.g., how many ports will be searched, since by defaultnmap will only scan 1000 most common ports. Service running on say port 24681 will not show up. It's uncommon).

But you STILL want to use nmap. I suggest to get a full view you try:

nmap -sT -Pn -T2 -vvv -A -p 1-65535 localhost

This will work fine, will take some time locally, and will NOT work well against non-localhost. This is because all networks are not the same. For example, if a network is VLAN'd, PVLAN'd, or separated/intersected with say IPS/IDS/Firewalls may respond different. For example, if a switch has some creative ACLs, your switch may intercept, and respond to the NMAP scan (not the target). This is usually the case when you see a target responding as if ALL ports are opened.

SUMMARY: To see what is running on YOUR machine, you're better off logging into it, and using something like lsof or netstat. If you're testing against your network LOCALLY (on the same subnet) you may need to fiddle with different services (TCP/UDP), timing (slow versus fast/insane scans), ports, and so forth.

Answer 2

I am not sure to understand whether you want to "list your local host sockets" or "scan TCP/UDP ports": I will write this post for the second meaning (scanning)

If your server is listening on UDP 55555, there is no point using -sT (TCP Scan) or -sS (TCP Syn Stealth scan) as it relies on the TCP handshake. (Syn - Syn/Ack - Ack). As suggested by munkeyoto you have to look at how the protocol works to understand what the scan does. (Book suggested: 'Practical Packet Analysis' or 'Nmap Network Discovery'). Also be aware that Windows does not support scanning your own machine (localhost) with SYN Stealth Scan

UDP scan works by sending an empty (no data) UDP header to every targeted port. Based on the response, or lack thereof, the port is assigned to one of four states:

• Any UDP response from target port (unusual) ==> open
• No response received (even after retransmissions) ==> open | filtered
• ICMP Port unreachable error (type 3, code 3) ==> closed
• Other ICMP unreachable errors (type 3, code 1, 2, 9, 10, or 13) ==> filtered

A good way to improve UDP port scanning reliability is to use Version Detection (a.k.a Service fingerprinting -sV):

To scan your UDP port, I would use :

$ sudo nmap -sUV <targetIP> -p 55555

If you want to scan more than one port, the scan would take significantly longer. (I'll refer you to https://nmap.org/book/man-performance.html)

If this whole post is confusing, I would recommend you to read the two books mentioned above, scanning techniques require some specific knowledge on TCP, UDP, ICMP and other protocols.

Answer 3

For TCP scanning, you can use a Bash shell and its network pseudo-device files, e.g.

for port in {1..65535}; do
  timeout 1 bash -c "</dev/tcp/localhost/$port" 2> /dev/null && echo Port $port open. || echo Port $port closed.
done