0

I have run nmap on an IP which is as follows

nmap -sW -PN <IP> 
result Host is up (0.0011s latency).
PORT      STATE SERVICE
1/tcp     open  tcpmux
3/tcp     open  compressnet
4/tcp     open  unknown
6/tcp     open  unknown
7/tcp     open  echo
9/tcp     open  discard
13/tcp    open  daytime
17/tcp    open  qotd
19/tcp    open  chargen
20/tcp    open  ftp-data
21/tcp    open  ftp
22/tcp    open  ssh
23/tcp    open  telnet
24/tcp    open  priv-mail
25/tcp    open  smtp
26/tcp    open  rsftp
30/tcp    open  unknown
32/tcp    open  unknown
33/tcp    open  dsp
37/tcp    open  time
42/tcp    open  nameserver
43/tcp    open  whois
49/tcp    open  tacacs
53/tcp    open  domain
70/tcp    open  gopher

but when I run nmap with

nmap -sW -PN -sV <ip>
PORT      STATE SERVICE    VERSION
1/tcp     open  tcpwrapped
3/tcp     open  tcpwrapped
4/tcp     open  tcpwrapped
6/tcp     open  tcpwrapped
7/tcp     open  tcpwrapped
9/tcp     open  tcpwrapped
13/tcp    open  tcpwrapped
17/tcp    open  tcpwrapped
19/tcp    open  tcpwrapped
20/tcp    open  tcpwrapped
21/tcp    open  tcpwrapped
22/tcp    open  tcpwrapped
23/tcp    open  tcpwrapped
24/tcp    open  tcpwrapped
25/tcp    open  tcpwrapped
26/tcp    open  tcpwrapped
30/tcp    open  tcpwrapped
32/tcp    open  tcpwrapped
33/tcp    open  tcpwrapped

I get the above result. In a https://secwiki.org/w/FAQ_tcpwrapped I read that "When a very large number of ports are shown as tcpwrapped, it is unlikely that they represent real services, so the behavior probably means something else like a load balancer or firewall is intercepting the connection requests. " So what should I infer from the above 2 results. Are the ports open on the host OR is the firewall/loadbalancer is intercepting the traffic?

1

Nmap without -sV (or other options that include service/version detection) makes no effort to determine what sort of service is actually running on a port. Instead, it simply does a lookup against a list of common port/service assignments in order to present a most-likely candidate for the type of service that would be running on ports included in the report.

This is what you're seeing with nmap -sW (for the purposes of this discussion, the -PN is irrelevant). Nmap is giving you a list of all the ports that the Window Scan thinks are open, and telling you what sort of services commonly listen on each port.

However, you should be aware that nmap -sW can be unreliable against targets that don't support the functionality it is designed to exploit. (And targets that do support that functionality are generally rare.) This is mentioned in the Nmap Port Scanning Techniques documentation, and appears to be exemplified by your results. (At least, the small portions you've pasted above - I assume they're truncated.)

The below is copied from the Nmap documentation I referenced above. Emphasis is mine.

-sW (TCP Window scan)
[...]
This scan relies on an implementation detail of a minority of systems out on the Internet, so you can't always trust it. Systems that don't support it will usually return all ports closed. Of course, it is possible that the machine really has no open ports. If most scanned ports are closed but a few common port numbers (such as 22, 25, 53) are filtered, the system is most likely susceptible. Occasionally, systems will even show the exact opposite behavior. If your scan shows 1,000 open ports and three closed or filtered ports, then those three may very well be the truly open ones.

With service & version detection enabled (e.g.: nmap -sW -sV in your examples), Nmap does some extra checks to be more certain of the ports' response states and to determine the type and version of application that's hosted on the open ports. These extra checks are what allow Nmap to provide the "tcpwrapped" determination, instead of just assuming that a responding port is running the service that commonly defaults to that number.

If there are any ports shown beyond the output you've pasted above, which do not report "tcpwrapped" in your nmap -sW -sV scan, it's probable that those are the only ports worth investigating further on the target. However, for more accurate results, you really should be using a different port scanning technique.

  • Thanks for the detailed explanation. All the ports have reported as tcpwrapped. So I think it is not worth spending time on investigating. – Lalitha Aug 18 '16 at 11:35
  • @Lalitha Yeah, I'd just stop using -sW for that target then. See what other scans might get you. Don't forget that Nmap also has IP spoofing and other stealth/impersonation features that can help to get around some firewalls. If you find another target on the network that's more responsive and might have access to the firewalled system, you might want to try using it in an idle scan or one of the other firewall/IDS evasion methods available. – Iszi Aug 18 '16 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.