3

I have setup a series of scripts to run regular nmap scans against our servers.

The results from day to day vary - for example one day it might report that only port 80 is open and the next day ports 21, 80 and 443 might be reported open.

The options I use are:

nmap -T4 -A -iL <ip list> -oA scan-$date

My setup is Kali 2016.1 on a hyper-v hosted virtual server, tunneling out of our DMZ to a Digital Ocean hosted Debian server using sshuttle.

I had assumed that the firewall or IDS was dropping or rejecting requests, but I've experimented with the timing and scan type options with no improvement to the consistency of the results.

Any ideas why this might be?

2

Your script is fine that you run on NMAP and consider the people in your company who use your servers/connected to the servers or network somehow, may be using software that open certain ports in order to run. For example, Skype uses port 80 and 443 by default. If it can't use those it will change to a different port. Make sure that you have narrowed this down completely. Try add the -sV option to see what is running from where, may give you more incentive.

Check your firewall, see if it is filtering out certain connections, make sure your applications or OS's are accepting TCP connections and check if there is anything with closed ports that are accepting packets but not being listened to by any application.

  • Okay, so the that aren't closed may report open or filtered depending on usage at that moment? – Leo Aug 10 '16 at 11:33
  • What do you mean? "the that aren't closed"? – iZodiac Aug 10 '16 at 11:34
  • sorry. ...the PORTS that... [edited]. – Leo Aug 10 '16 at 11:36
  • Yeah, so ports that aren't closed will most definitely report open if your search range is wide enough to find them. Filtered is dependent on server firewalls, and how your system deals with incoming and outgoing connections. – iZodiac Aug 10 '16 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.