I am using Nmap 7.12 on Mac OS X. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP replies and vice versa. I am scanning an IP inside the subnet as per the below information with the Nmap command:
root# Nmap -sS 192.168.0.171 Starting Nmap 7.12 ( https://nmap.org ) at 2016-05-28 00:41 SGT Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 0.49 seconds
When I run tcpdump to see the traffic and where it's going, it shows all these ports being scanned when the Nmap command is run, and the Nmap scan completes successfully.
root# nmap -sS 192.168.0.171 Starting Nmap 7.12 ( https://nmap.org ) at 2016-05-28 00:52 SGT Nmap scan report for 192.168.0.171 Host is up (0.00092s latency). Not shown: 998 filtered ports PORT STATE SERVICE 22/tcp open ssh 53/tcp open domain MAC Address: 08:00:27:58:0E:98 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.71 seconds
However, as soon as I stop tcpdump and re-run the Nmap scan, it then states that the host is down.
What am I missing here?