nmap - Difference between “Filtered” and “Admin-Prohibited”

Question

I am a rather new user to nmap. By using some Google-Fu, I am still not able to ascertain what is the criteria used in order to distinguish "filtered" ports from "admin-prohibited" as they both seem related to firewall or network restrictions in general.

As I understand (but maybe I'm wrong), the "filtered" word is used when a port is behind a firewall, for example:

Nmap scan report for 10.0.0.2
Host is up, received user-set (0.026s latency).
All 500 scanned ports on 10.69.72.3 are filtered because of 438 no-responses and 62 admin-prohibiteds

In this case, nmap has been launched with the -Pn parameter in order to perform a host discovery, so that's the reason for the "user-set" and the relative filtered ports.

But I don't get why (and especially how) are those 62 admin-prohibited ports shown, so are they the same thing as "filtered"?

Answer 1

"Filtered" means "I sent something, I never got a response, it just disappeared, so I'm guessing that something is filtering the packets out and quietly dropping them."

"Admin Prohibited" means "I sent something, and I got back an ICMP 'Admin Prohibited' packet, which clearly indicates that I'm being actively blocked."

Answer 2

Nmap port scan output shows (at least) 2 different things for each port: the state of the port, and the reason why Nmap decided on that state. In your output, all the ports in the filtered state are being presented together, with counts for each of the two reasons it decided on that state for each port.

Port States

A port is really just an address, and at the most basic level there are two states the port can be in: open and closed. An open port means that a process is listening and will open a connection with someone who sends a packet to that address. A closed port means that there is no process listening, and the operating system will reject a connection to that address explicitly.

There is one more state, though, and that is what your question is about: the filtered state. This is less about the state of the port, and more about Nmap's internal state: it simply can't know whether something is listening because something else is interfering with or filtering the connection attempts. There may or may not be a process listening on that port, but either way, your scanner is not being allowed to find out.

Reasons

When a TCP port is open, there is pretty much only one reason Nmap reports: syn-ack. Similarly, when closed it is reset. There are a few exceptions for other scan types (TCP Connect may be implemented differently on different systems, resulting in conn-refused, for instance). But for the "filtered" state, the reason depends on what the filtering system (most frequently a firewall) does when it receives one of Nmap's probes. Most firewalls will respond in one of two ways: dropping the incoming connection without responding at all, or sending a ICMP Administratively Prohibited message. These are the two reasons that your output shows: dropped connections are no-response, and the other are admin-prohibited.