0

What could be the possible reason(s) of scanning a port and getting an open (syn-ack) response and then getting a closed (rst) response within a small timeframe.

Starting Nmap 7.25BETA1 ( https://nmap.org ) at 2018-03-24 21:01 AST
Nmap scan report for 10.0.2.13
Host is up, received reset ttl 127 (0.14s latency).
PORT   STATE SERVICE REASON
80/tcp open  http    syn-ack ttl 127

Starting Nmap 7.25BETA1 ( https://nmap.org ) at 2018-03-24 21:06 AST 
Nmap scan report for 10.0.2.13 
Host is up, received reset ttl 127 (0.14s latency). 
PORT   STATE  SERVICE REASON
80/tcp closed http    reset ttl 127

I think I have eliminated the possibility of a firewall due to not getting any response for a --badsum packet

  • 1
    Do you get an open response again? If not, then this is not "inconsistent" but a "changed" response. Lots of possible reasons, one of which is simply that the server noticed that nmap was used and blocked you. – schroeder Mar 25 '18 at 15:47
1

If you make a tcpdump of a nmap session, you will see that nmap sends a lot of packets, this patter is very easy to detect, and probably your session have been detected and then blocked automatically. Port scans are easy to detect by firewalls or other systems, that is my guess.

-1

It is possible this is a result of a Virtual IP. If there are multiple hosts linked to the one IP address, as if behind a load balancer, you can pull one host on one call and another on the next, and possibly one is having an issue with its webserver. Here are some options to troubleshoot:

Telnet to the port and see if it fails intermittently or if it works every time.

telnet 10.0.2.13 80

You can also run nmap in debug mode and try to get a better view of what's going on.

nmap -d3 -p80 10.0.2.13

and you can do reverse DNS to see if it has a VIP like name:

dig -x 10.0.2.13

It is also possible it is rate limiting. Debug NMAP should detect that, but a wireshark scrape might be more helpful to see any responses pushed back to your client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.