What are possible reasons why an
nmap -sT scan would show "ports filtered" but an identical
nmap -sS scan shows "ports closed"? I understand that
-sT is a full TCP Connect, which is easier to detect (and to filter) than the
-sS half open scan. But why?
Both types of scans send a SYN packet; both types of scans should expect back a SYN|ACK or a RST. The only difference that I see is that the half open scan will send a RST instead of finishing the connection handshake.
Also, I ran the command
nmap -sT -P0 which tells nmap not to send a ping first (I think it typically does both a TCP ping and an ICMP ping). Doing that command causes it to respond with "ports closed" which is identical to the
-sS scan response. Is that because
-sT is normally being blocked due to pinging first?
That's my assumption, but I want some more experienced opinions about what I am seeing and what types of scans I can do to investigate further. Btw, I am of course allowed to be doing these scans (class work).