I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with port 25, and suddenly it is showing
filtered instead of
I start tinkering to see if I can try to troubleshoot this problem. First I try running the same scan again to see if maybe I got the wrong IP. Same list, but I chose the next result. Try the new IP with port 25, shows
Now I'm trying to figure out how I can get it to show
open on that one IP. I scan the same single IP with no specified port, and port 25, along with others show as
open. Scan the same IP with just port 25, and it says
filtered. I add one more port from the previous scan, and port 25 and the other port show as
It confuses me why running
nmap -p 25 [IP] gives me
25/tcp filtered smtp yet running the same command with at least two ports gets me a positive result.
Am I missing something? Can someone explain what I'm doing wrong?
I did write in the title that maybe the scan was too fast, because I had already tried the -T flag.
The commands that I used in the process of troubleshooting and their result:
nmap 10.11.1.227 ... PORT STATE SERVICE 21/tcp open ftp 25/tcp open smtp 80/tcp open http 135/tcp open msrpc 139/tcp open netbios-ssn 443/tcp open https 445/tcp open microsoft-ds 1025/tcp open NFS-or-IIS 1026/tcp open LSA-or-nterm 1028/tcp open unknown 3372/tcp open msdtc 5800/tcp open vnc-http 5900/tcp open vnc
I tried one port with scripts (which failed, so I tried one port no scripts):
nmap -p 25 10.11.1.227 ... PORT STATE SERVICE 25/tcp filtered smtp
I tried two ports that I know are open:
nmap -p 25,5900 10.11.1.227 ... PORT STATE SERVICE 25/tcp open smtp 5900/tcp open vnc
At that point I think about whether probing one port is too fast and decide to try -T4, then -T3, and then finally:
nmap -p 25 -T2 10.11.1.227
Gives me a positive result. So problem fixed right? Not in my head. I want to know if I'm doing something wrong, or if this is unavoidable, and I just have to accept the solution as is. And if that is the case, and someone knows why, I would also like to know why that is the case.