I'm currently studying a peneteration/hacking course. I am trying to use nmap against a target to find all the ports that are filtered.

I thought if I used an ACK-scan nmap would give me all the filtered ports. I used

nmap -sA -p- target

and the result was All the 65535 ports scanned are unfiltered. Is this even reasonable? What other scans can I use to complement my first scan?


Assuming that you've used one of the standard scan types initially (e.g. SYN or TCP scan) and you're getting back no open ports, I'd say that either the system has no open ports (the most likely real-world scenario) or there's some specific point your course is trying to teach (should be mentioned in the course materials) that would require a specific scan type to bypass some protection on the host. If it's the later I'd try the various types of scan that nmap makes available and see which, if any, produce anomolous results.

The nmap documentation for the ACK scan type is relatively clear

This scan is different than the others discussed so far in that it never determines open (or even open|filtered) ports. It is used to map out firewall rulesets, determining whether they are stateful or not and which ports are filtered. The ACK scan probe packet has only the ACK flag set (unless you use --scanflags). When scanning unfiltered systems, open and closed ports will both return a RST packet. Nmap then labels them as unfiltered, meaning that they are reachable by the ACK packet, but whether they are open or closed is undetermined. Ports that don't respond, or send certain ICMP error messages back (type 3, code 0, 1, 2, 3, 9, 10, or 13), are labeled filtered.

The ACK scan is just used to probe for weakesses in firewalls. In real world tests you're not that likely to hit a non-stateful firewall, but again if this is a course, it's possible that that's a point their trying to teach.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.