Inconsistent nmap results

Question

I have setup a series of scripts to run regular nmap scans against our servers.

The results from day to day vary - for example one day it might report that only port 80 is open and the next day ports 21, 80 and 443 might be reported open.

The options I use are:

nmap -T4 -A -iL <ip list> -oA scan-$date

My setup is Kali 2016.1 on a hyper-v hosted virtual server, tunneling out of our DMZ to a Digital Ocean hosted Debian server using sshuttle.

I had assumed that the firewall or IDS was dropping or rejecting requests, but I've experimented with the timing and scan type options with no improvement to the consistency of the results.

Any ideas why this might be?

Answer 1

Your script is fine that you run on NMAP and consider the people in your company who use your servers/connected to the servers or network somehow, may be using software that open certain ports in order to run. For example, Skype uses port 80 and 443 by default. If it can't use those it will change to a different port. Make sure that you have narrowed this down completely. Try add the -sV option to see what is running from where, may give you more incentive.

Check your firewall, see if it is filtering out certain connections, make sure your applications or OS's are accepting TCP connections and check if there is anything with closed ports that are accepting packets but not being listened to by any application.