1

When I run a nmap scan against a remote target, it shows port 25 closed but an online nmap tool like (https://hackertarget.com/nmap-online-port-scanner/) shows that port 25 is open.

 sudo nmap -sS -v 194.95.6.16 -p 25 --reason
 PORT   STATE  SERVICE REASON
 25/tcp closed smtp    reset

Which result is true and why the other one is displaying a different result?

PORT STATE SERVICE REASON 
25/tcp closed smtp reset 
TRACEROUTE (using port 80/tcp) 
HOP RTT ADDRESS 
1 61.28 ms 192.168.0.1 
2 4.16 ms rsm4151x-ndr.net.hrz.tu-darmstadt.de (130.83.21.254) 
3 14.89 ms corel506-rsm4151x.net.hrz.tu-darmstadt.de (130.83.253.74) 
4 4.19 ms cores101-corel506.net.hrz.tu-darmstadt.de (130.83.99.33) 
5 4.18 ms mx01-1.mpi-bremen.de (194.95.6.16)

I ran with traceroute option of nmap. How to find where is the firewall or IDS or even it's existing or not ?

Improve this question
3
  • 1
    If one scan says it is open, then it is open. There is something preventing the scan saying that it is closed.
    – schroeder ♦
    Jan 16, 2017 at 16:11
  • I ran root@bolt:/home/roshan# traceroute -T -p 25 194.95.6.16 gives same output as traceroute option of nmap. How to find where and what is blocking me.
    – Kumar Roshan Mehta
    Jan 16, 2017 at 16:38
  • If your packets make it all the way, then you have your answer. The mail server is dropping you.
    – schroeder ♦
    Jan 16, 2017 at 17:47

4 Answers 4

Reset to default
3

What does closed state means:

A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next.

https://nmap.org/book/man-port-scanning-basics.html

It can be firewall or IDS system. Also I have checked and it states that port 25 is open:

PORT   STATE  SERVICE
25/tcp open   smtp

You can also try telnet:

telnet 194.95.6.16 25
Trying 194.95.6.16...
Connected to 194.95.6.16.
Escape character is '^]'.
220 mx01.mpi-bremen.de ESMTP
Improve this answer
2
  • I ran root@bolt:/home/roshan# traceroute -T -p 25 194.95.6.16 gives same output as traceroute option of nmap. How to find where and what is blocking me.
    – Kumar Roshan Mehta
    Jan 16, 2017 at 16:38
  • So before you hop to the actual server, you are forced to go through fw1.mpi-bremen.de, which is probably firewall, and perhaps that one is blocking you.
    – Mirsad
    Jan 16, 2017 at 18:08
2

Which result is true and why the other one is displaying a different result?

Why couldn't both answers be true?

The port is open when visited by one host... it is closed when visited by another host.

The simplest explanation is that either your network (or even country) is blocked - I know of several machines that are only accessible from European networks - or that your host or subnet has been banned. For example by fail2ban.

Improve this answer
1

The most likely case is that the port is open, but something is blocking that port on your end. The online Nmap scan is run from a different network, so it does not have the same restriction.

Port 25 (SMTP, used for email) is often blocked by ISPs for residential customers. In order to cut down on spam, they require a commercial account in order to send and receive SMTP mail.

Improve this answer
1
  • 1
    Even if he ran traceroute -T -p 25 194.95.6.16? If his ISP was blocking it, should the trace end at the first hop?
    – schroeder ♦
    Jan 17, 2017 at 13:52
0

This issue is common, what any one who has this kind of problem is to run several scans from external sources, perhaps you proxies, to see if it's is not location based Run serveral online port scanners in different locations, if the result they give is the same the, probably, it's something internal

Check firewall rules could just be blocking internal, but not external

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .