I just finished scanning a host and I found something unusual. My question is regarding port 50000 and 50002. Nmap shows that these ports are closed and also identifies the services running on them!How is that possible? Doesn't a closed port mean that there isn't anything running on it?
papagolf@Sierra:~$ nmap -v www.****.com Host is up (0.28s latency). rDNS record for 50.***.***.***: ----- Not shown: 987 filtered ports PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http 443/tcp open https 50000/tcp closed ibm-db2 50001/tcp closed unknown 50002/tcp closed iiimsf 50003/tcp closed unknown 50300/tcp closed unknown 50389/tcp closed unknown 50500/tcp closed unknown 50636/tcp closed unknown 50800/tcp closed unknown