0

I am trying to learn more about Nmap but it seems like it can only really give any information if you're actually connected to the network you're scanning on. For example, a friend and I gave each other our public IP addresses to see what we can do with it, but even if you try to scan that IP address it only tells you it's online, it doesn't return open ports or mac addresses? So is Nmap pretty more useless unless you can get to the internal network?

3

1 Answer 1

2

So is Nmap pretty more useless unless you can get to the internal network?

No, it was super useful! It answered the question of how exposed your system is on the internet. It found nothing, so it looks like you have no open ports. Great news!

it seems like it can only really give any information if you're actually connected to the network you're scanning

Well, if there is nothing but a black void, what do you expect an observer to say? Nmap cannot make bricks without clay. If the remote end does not answer to anything, what do you expect it to tell you? If there is no information to be had, no tool will be able to provide you with information unless it is making it up on the fly.


Did you let Nmap scan on all ports (-p-), UDP and TCP (-sU, -sS), and enable things like OS detection (-O) and service scans (-sV)? One reason why you're getting less information than you expected might be that you did not enable all the options. Note that some may take forever or be harmful to certain systems -- there is a reason not everything is turned on by default. Knowing what to enable in different situations* requires gaining a bit of experience with network scanning in general.

It could also be, but consumer routers typically don't do this, that the remote system detected there was a scan going on and (temporarily) blocked you.

* In your situation, with a regular consumer router and your systems sitting behind a stateful firewall, it is not weird that it sees literally nothing. If it doesn't respond to commonly offered internal services like DNS, NTP, UPNP, SIP, maybe a web management portal TCP port, etc., then you can enable all the options and let it scan for weeks but likely not get any result. You can be happy the systems responded to ping at all; not all routers reveal that they are online. (Personally I find it somewhat security through obscurity to not respond to ping, but that's another discussion.)

2
  • Is it possible to get a machine MAC address that's on another network? What about their local address? For example if I have the public IP can I figure out what their local IP is?
    – user283176
    Sep 24, 2022 at 5:37
  • @user283176 Please see my answer here for an overview of how the internet works: security.stackexchange.com/questions/1118/…
    – Luc
    Sep 24, 2022 at 7:32

Not the answer you're looking for? Browse other questions tagged .