I am going to try explaining my question in the simplest way possible.
I have a script which uses nmap to scan for open ports and save the result in a file. The next time it scans a host it moves the old saved nmap report and creates a new one, lastly it compares these 2 reports to see what ports have been changed. That is, if a machine had a port say (80/tcp , 22tcp) open in previous scan result; and if the new scan result consists of only (80/tcp) then the script notifies a slack channel as :
CHANGE OCCURED FROM (80/tcp , 22tcp) ===> (80/tcp)
so lately I have been having too many notifications from some of the machines, it keeps on changing port i.e from OPEN to CLOSE and CLOSE to OPEN. Now this script runs every 15 mins and I am really not sure why for some of the machines this keeps happening since I have seen that the ports do not change by manually logging in the machines.
There are no IDS on the machines which show this behavior. Is it possible that the machines are dropping NMAP traffic?