I want to use Nmap for port knocking on CTF machines, so I've read the manual for configuring it properly:

nmap <ip> -p <port1>,<port2>,... -r --max-retries 0 --max-parallelism 1

In particular, -r ensures ports are scanned in the listed order, --max-retries 0 ensures that ports are not probed more than once, and max-parallelism 1 ensures that only a single thread runs.

However, the above Nmap command fails to open the hidden service. If I instead use the following port knocking client everything just works:


Any ideas?

  • 1
    This seems to be off-topic, as it is not an actual security question. You are essentially asking "What parameters do I need in nmap to do the thing?" and as such you would be better off migrating this question to Super User. – MechMK1 May 8 '19 at 12:15
  • @MechMK We do however answer questions about the usage of security-related tools. – Arminius May 8 '19 at 14:17
  • 1
    Why do you want to use nmap instead of a tool specifically made to generate custom packets like hping? – Arminius May 8 '19 at 14:18
  • @Arminius Does "How can I use a security tool for something it was not designed to do?" fall in the scope of Sec.SE? In that case, I would retract my flag and delete my comment. – MechMK1 May 8 '19 at 14:22
  • There are so many other tools to do this. And since nmap isn't working for you, then you should switch to a tool that does. – schroeder May 8 '19 at 14:25

The knock script sets the socket to 'non-blocking'. Non-blocking in python is the same as setting the timeout to 0 - that is, don't wait for a response. The TCP protocol defaults to 'blocking' - i.e wait for a response.

From Knock git the relevant line is: s.setblocking(False).

Try playing with the settings in nmap that set timeouts to 0:


--min-rtt-timeout <time>, --max-rtt-timeout <time>, --initial-rtt-timeout <time> (Adjust probe timeouts) or --host-timeout <time> (Give up on slow target hosts) (suspect it will be the first one though).

Also, you might find that having wireshark running in the background to capture all the traffic to and from the server being useful, as you'd have a record of what was being sent when using nmap and knock, you might uncover something that way by comparing the results.

  • Thanks for the clarification; however, the options doesn't seem to make Nmap work as a port knocking client (I've tried them all). In particular, the following error is given Bogus --max-rtt-timeout argument specified, must be at least 5ms, so I cannot set it to 0. – Shuzheng May 8 '19 at 13:33
  • @Shuzheng Of course you can't set it to 0. Afterall, nmap is built to expect a response from a probe. That's the idea of it afterall. By trying to use nmap to do port knocking, you're doing the same as using a frozen banana to hammer in a nail. It's just not made for this task. – MechMK1 May 8 '19 at 14:00

The default behavior of the knock client differs from your nmap command line in the following:

  • uses TCP connect (not just SYN probes)
  • introduces a delay of 200ms
  • waits for a timeout of 200ms
  • does not ping the host (by default nmap does it with a TCP 80 SYN, introducing an additional initial knock in the sequence)

Maybe the implementation of your server depends from one of those. To match the same bahavior you may want to try the following:

nmap <ip> -p <port1>,<port2>,... -r --max-retries 0 --max-parallelism 1 -sT --scan-delay 200ms --max-rtt-timeout 200ms -Pn

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.