I have setup a series of scripts to run regular nmap scans against our servers.
The results from day to day vary - for example one day it might report that only port 80 is open and the next day ports 21, 80 and 443 might be reported open.
The options I use are:
nmap -T4 -A -iL <ip list> -oA scan-$date
My setup is Kali 2016.1 on a hyper-v hosted virtual server, tunneling out of our DMZ to a Digital Ocean hosted Debian server using sshuttle.
I had assumed that the firewall or IDS was dropping or rejecting requests, but I've experimented with the timing and scan type options with no improvement to the consistency of the results.
Any ideas why this might be?