I am using Nmap 7.12 on Mac OS X. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP replies and vice versa. I am scanning an IP inside the subnet as per the below information with the Nmap command:
root# Nmap -sS 192.168.0.171 Starting Nmap 7.12 ( https://nmap.org ) at 2016-05-28 00:41 SGT Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 0.49 seconds
When I run tcpdump to see the traffic and where it's going, it shows all these ports being scanned when the Nmap command is run, and the Nmap scan completes successfully.
root# nmap -sS 192.168.0.171 Starting Nmap 7.12 ( https://nmap.org ) at 2016-05-28 00:52 SGT Nmap scan report for 192.168.0.171 Host is up (0.00092s latency). Not shown: 998 filtered ports PORT STATE SERVICE 22/tcp open ssh 53/tcp open domain MAC Address: 08:00:27:58:0E:98 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.71 seconds
However, as soon as I stop tcpdump and re-run the Nmap scan, it then states that the host is down.
What am I missing here?
ip addr showon the server that you are directing the scan at, initially at least while tcpdump is not running. Also, is that server running anything like fail2ban or friends?