0

When I run a nmap scan against a remote target, it shows port 25 closed but an online nmap tool like (https://hackertarget.com/nmap-online-port-scanner/) shows that port 25 is open.

 sudo nmap -sS -v 194.95.6.16 -p 25 --reason
 PORT   STATE  SERVICE REASON
 25/tcp closed smtp    reset

Which result is true and why the other one is displaying a different result?

PORT STATE SERVICE REASON 
25/tcp closed smtp reset 
TRACEROUTE (using port 80/tcp) 
HOP RTT ADDRESS 
1 61.28 ms 192.168.0.1 
2 4.16 ms rsm4151x-ndr.net.hrz.tu-darmstadt.de (130.83.21.254) 
3 14.89 ms corel506-rsm4151x.net.hrz.tu-darmstadt.de (130.83.253.74) 
4 4.19 ms cores101-corel506.net.hrz.tu-darmstadt.de (130.83.99.33) 
5 4.18 ms mx01-1.mpi-bremen.de (194.95.6.16)

I ran with traceroute option of nmap. How to find where is the firewall or IDS or even it's existing or not ?

  • 1
    If one scan says it is open, then it is open. There is something preventing the scan saying that it is closed. – schroeder Jan 16 '17 at 16:11
  • I ran root@bolt:/home/roshan# traceroute -T -p 25 194.95.6.16 gives same output as traceroute option of nmap. How to find where and what is blocking me. – Roshan Mehta Jan 16 '17 at 16:38
  • If your packets make it all the way, then you have your answer. The mail server is dropping you. – schroeder Jan 16 '17 at 17:47
2

What does closed state means:

A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next.

https://nmap.org/book/man-port-scanning-basics.html

It can be firewall or IDS system. Also I have checked and it states that port 25 is open:

PORT   STATE  SERVICE
25/tcp open   smtp

You can also try telnet:

telnet 194.95.6.16 25
Trying 194.95.6.16...
Connected to 194.95.6.16.
Escape character is '^]'.
220 mx01.mpi-bremen.de ESMTP
  • I ran root@bolt:/home/roshan# traceroute -T -p 25 194.95.6.16 gives same output as traceroute option of nmap. How to find where and what is blocking me. – Roshan Mehta Jan 16 '17 at 16:38
  • So before you hop to the actual server, you are forced to go through fw1.mpi-bremen.de, which is probably firewall, and perhaps that one is blocking you. – Mirsad Jan 16 '17 at 18:08
1

Which result is true and why the other one is displaying a different result?

Why couldn't both answers be true?

The port is open when visited by one host... it is closed when visited by another host.

The simplest explanation is that either your network (or even country) is blocked - I know of several machines that are only accessible from European networks - or that your host or subnet has been banned. For example by fail2ban.

1

The most likely case is that the port is open, but something is blocking that port on your end. The online Nmap scan is run from a different network, so it does not have the same restriction.

Port 25 (SMTP, used for email) is often blocked by ISPs for residential customers. In order to cut down on spam, they require a commercial account in order to send and receive SMTP mail.

  • Even if he ran traceroute -T -p 25 194.95.6.16? If his ISP was blocking it, should the trace end at the first hop? – schroeder Jan 17 '17 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.