1

I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between.

I tried the SYN scan, and when I check the traffic in WireShark I see the SYN/ACK reply for every port. Same goes for the TCP Connect scan, I see the full handshake, etc..

If I for example try to connect to 5900 using vnc viewer, I receive the connecting message but that's it.

I'm looking for a reliable way to check for open ports.

3

If you are getting SYN/ACKs, then the ports are open. The firewall may be responding to all ports on behalf of the server behind it if there are no forwarding rules configured.

If you mean that you want to know if there are legitimate running services on those ports, then you need to do what you just did: connect to them and "banner grab".

Nmap can do all that.

  • If this is the case, I wonder how entire ranges have hosts full with this behavior. Don't you need to explicitly enable all ports first? – Tooz Oct 15 '18 at 14:21
  • 1
    There are a lot of variables to consider. Without an understanding of the network architecture between the scanner and the targets, I can only guess. – schroeder Oct 15 '18 at 14:25
  • 1
    I've also seen people configure things like this to slow down attackers doing service detection with nmap. If it has to check all the ports, it takes a lot longer than just checking the ones that really are legitimately open. It's not really a great defensive strategy, but it is a simple one, and it only costs you bandwidth once set up. – Austin Hemmelgarn Oct 15 '18 at 18:19
  • @AustinHemmelgarn agreed, although this can DoS your network if you are not careful. – schroeder Oct 15 '18 at 18:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.