Without access to firewall rules, I want to scan allowed outbound (destination) ports on the local machine.

I would take too long to start a netcat listener for each of the destination ports on a remote host, to connect to, for testing.

Is there a smarter way, preferably using Bash scripting?


If you just care which ports are allowed as outgoing target on your machine just do a packet capture at the remote host to see which packets from your client reach the remote host. There does not need to be a listener there in order for the packet to arrive at the host, it only needs a listener in order to respond to the packet.

  • Thank you. So, you would run tcpdump or Wireshark on the remote host? – Shuzheng Jun 26 '18 at 17:10
  • @Shuzheng: yes, any of these will do. For automatic analysis (i.e. process the output with some script) a command line based client like tcpdump or tshark is probably preferable. – Steffen Ullrich Jun 26 '18 at 17:14
  • Doesn't the network card need to be put into some special mode in order for tcpdump to see the packets? – Shuzheng Jun 26 '18 at 17:16
  • 1
    @Shuzheng: you probably mean promiscuous mode - this is only needed to capture all packets arriving at the network card including packets not destined for this specific target. This is not needed here. – Steffen Ullrich Jun 26 '18 at 17:18
  • Indeed. I like your answer. If no better answer comes in near future, I will accept it. – Shuzheng Jun 26 '18 at 17:22

You could run nmap on the local host and setup a nc listener on a remote host.

On the remote host you could use something along these lines:

for i in seq 1 65000; do nc -l $i &; sleep 1; done

Depending on how beefy the remote host is I’d be careful around the sleep section. The sleep is there to prevent it from spawning an excessive number of netcat processes at once.

On the local host run the following:

nmap -p- -PN

Then just wait for the results.

  • Wouldn't nmap check the ports much faster than nc process them, i.e. lots of false positives would be reported? What if nmap isn't available on the local host? – Shuzheng Jun 26 '18 at 17:08
  • Nc is soley there to be a listener the other side of the firewall. It is still nmap that is doing the scanning. Netcat is just there to confirm that nmap can communicate via that port through the firewall. You can get nmap on any OS pretty much. – RT Security Jun 26 '18 at 17:16
  • Note that the proposed script would take like 65000 (~18 hours) seconds to complete. – NonStandardModel Jun 26 '18 at 17:17
  • ^^^ What they said – RT Security Jun 26 '18 at 17:18
  • @NonStandardModel - Indeed, this would be a problem. Still, if I let nmap run without the 1 second delay, then nmap would scan all 65535 ports before nc would have a chance for listening on them. – Shuzheng Jun 26 '18 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.