1

I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between.

I tried the SYN scan, and when I check the traffic in WireShark I see the SYN/ACK reply for every port. Same goes for the TCP Connect scan, I see the full handshake, etc..

If I for example try to connect to 5900 using vnc viewer, I receive the connecting message but that's it.

I'm looking for a reliable way to check for open ports.

Improve this question

2 Answers 2

Reset to default
4

If you are getting SYN/ACKs, then the ports are open. The firewall may be responding to all ports on behalf of the server behind it if there are no forwarding rules configured.

If you mean that you want to know if there are legitimate running services on those ports, then you need to do what you just did: connect to them and "banner grab".

Nmap can do all that.

Improve this answer
4
  • If this is the case, I wonder how entire ranges have hosts full with this behavior. Don't you need to explicitly enable all ports first?
    – tooz
    Oct 15, 2018 at 14:21
  • 1
    There are a lot of variables to consider. Without an understanding of the network architecture between the scanner and the targets, I can only guess.
    – schroeder ♦
    Oct 15, 2018 at 14:25
  • 2
    I've also seen people configure things like this to slow down attackers doing service detection with nmap. If it has to check all the ports, it takes a lot longer than just checking the ones that really are legitimately open. It's not really a great defensive strategy, but it is a simple one, and it only costs you bandwidth once set up.
    – Austin Hemmelgarn
    Oct 15, 2018 at 18:19
  • @AustinHemmelgarn agreed, although this can DoS your network if you are not careful.
    – schroeder ♦
    Oct 15, 2018 at 18:36
0

The same happened to me this week. I always scan my own servers after setup to make sure they are working fine before delivery and suddenly started to get reports of all ports open. Where in fact I was sure they weren't. Your post made me wonder if it wasn't related to Wireshark and indeed it seems so since uninstalling Wireshark (which I had recently added to that computer) made my nmap behave "normal" again... Maybe that helps someone.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .