1

I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with port 25, and suddenly it is showing filtered instead of open.

I start tinkering to see if I can try to troubleshoot this problem. First I try running the same scan again to see if maybe I got the wrong IP. Same list, but I chose the next result. Try the new IP with port 25, shows filtered.

Now I'm trying to figure out how I can get it to show open on that one IP. I scan the same single IP with no specified port, and port 25, along with others show as open. Scan the same IP with just port 25, and it says filtered. I add one more port from the previous scan, and port 25 and the other port show as open.

It confuses me why running nmap -p 25 [IP] gives me 25/tcp filtered smtp yet running the same command with at least two ports gets me a positive result.

Am I missing something? Can someone explain what I'm doing wrong?

I did write in the title that maybe the scan was too fast, because I had already tried the -T flag.

The commands that I used in the process of troubleshooting and their result:

nmap 10.11.1.227
...
PORT     STATE SERVICE
21/tcp   open  ftp
25/tcp   open  smtp
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
443/tcp  open  https
445/tcp  open  microsoft-ds
1025/tcp open  NFS-or-IIS
1026/tcp open  LSA-or-nterm
1028/tcp open  unknown
3372/tcp open  msdtc
5800/tcp open  vnc-http
5900/tcp open  vnc

I tried one port with scripts (which failed, so I tried one port no scripts):

nmap -p 25 10.11.1.227
...
PORT   STATE    SERVICE
25/tcp filtered smtp

I tried two ports that I know are open:

nmap -p 25,5900 10.11.1.227
...
PORT     STATE SERVICE
25/tcp   open  smtp  
5900/tcp open  vnc

At that point I think about whether probing one port is too fast and decide to try -T4, then -T3, and then finally:

nmap -p 25 -T2 10.11.1.227

Gives me a positive result. So problem fixed right? Not in my head. I want to know if I'm doing something wrong, or if this is unavoidable, and I just have to accept the solution as is. And if that is the case, and someone knows why, I would also like to know why that is the case.

1

It does indeed seem like a timing issue. nmap might be timing out on the single scan and reporting the results as filtered. With the other ports or systems included in the scan, the timeout might be different.

To find out what is going on, you will have to run a packet capture. Wireshark is the de facto tool for this. Run nmap -p 25 10.11.1.227 and capture the results, then run nmap -p 25,5900 10.11.1.227 and capture the results. Compare the differences. Chances are that the differences are obvious.

In general, when things like this happen, always go to the packet traces to see what's going on. You will learn a lot.

  • Didn't think about using wireshark to troubleshoot. Thank you! – Shelby M. Oct 6 '18 at 14:03
-1

Filtered means that port is secured by a firewall installed by the company. You cannot send or receive any information through that port as you are an outsider. Do some research on port filtering. That's actually a security action to avoid unauthorized access to their company network. You can evade the firewall with these commands in nmap. Good Luck

https://www.stationx.net/nmap-cheat-sheet/ ( See the firewall evasion section at the bottom )

https://youtu.be/goTeHX0-_b0

  • 1
    Why would it show as open if more than one port is scanned? Wouldn't a firewall have blocked those, too? – schroeder Oct 6 '18 at 9:52
  • I know what filtered means. The problem is that in all the single IP, I get back filtered. – Shelby M. Oct 6 '18 at 13:40
-1

Use -Pn

-Pn: Treat all hosts as online -- skip host discovery

nmap -Pn -p 25 [IP address]

Equally, -T<0-5> allows you to set timing.

-T<0-5>: Set timing template (higher is faster)

nmap -T4 -p 25 [IP address]

Nmap has a reference guide Timing and Performance.

See, Why are some ports reported by nmap filtered and not the others?

  • I'm not sure if this answers why the same port shows as filtered on some scans but closed on others. – schroeder Oct 6 '18 at 12:39
  • -Pn doesn't answer my question. Host showing online isn't the problem. Though I did try it with the same result as nmap -p 25 [IP]. -T2 fixes my problem, but is that the only solution, and why? – Shelby M. Oct 6 '18 at 13:41
  • @ShelbyM. As already suggest use Wireshark, but I imagine this is timing related to the SMTP server. Although, it might be worthwhile considering a firewall could be causing this, as this is why timings exist within Nmap. As mentioned in the reference, 'You issue an SYN, if the server does not reply, or replies with ICMP error: it means that the port is filtered. Likely an IDS / stateful firewall block your request)' – safesploit Oct 6 '18 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.