I have different results as of my open TCP ports. When using nmap -sS, I get some 5 usual open ports, but when using osx built-in tool as stroke, I get those 5 ports plus 5 extra ports. How can it come ?

first nmap -sS

Starting Nmap 6.25 ( http://nmap.org ) at 2013-07-03 12:00 CEST
Nmap scan report for localhost (
Host is up (0.00012s latency).
Not shown: 995 closed ports
80/tcp   open  http
88/tcp   open  kerberos-sec
548/tcp  open  afp
631/tcp  open  ipp
8888/tcp open  sun-answerbook

and ./stroke 0 6000 gives

Open TCP Port:  80          http
     Open TCP Port:     88          kerberos
     Open TCP Port:     548         afpovertcp
     Open TCP Port:     631         ipp
     Open TCP Port:     4370
     Open TCP Port:     4371
     Open TCP Port:     4380
     Open TCP Port:     4381
     Open TCP Port:     5037
  • It would be useful to show the output of both programs and the options you used. – Lucas Kauffman Jul 3 '13 at 10:31
  • @LucasKauffman see update – epsilones Jul 3 '13 at 10:36

My guess is that you aren't seeing those open ports is because of the default behavior of nmap to only scan the 1.000 most commonly used ports.

If you want to cover all ports you need to explicitly state that you want to scan all ports with the -p parameter. So say I want to scan from port 1 until 5037:

nmap -sS -p1-5037

To view which process is running on what port:

sudo lsof -i -P | grep -i "listen"
  • thank you for your response ! So now, how can it be that those ports are open, how can I know which applications is using those ports ? – epsilones Jul 3 '13 at 10:47
  • updated my answer, you can just lookup what process is using that particular PID – Lucas Kauffman Jul 3 '13 at 10:51
  • sorry when runnig your command I get lsof: unacceptable port specification in: -i 4TCP: lsof 4.85 – epsilones Jul 3 '13 at 10:57
  • did you change $port to the given port? I'll update my question – Lucas Kauffman Jul 3 '13 at 11:04
  • 1
    nmap is used for scanning open ports on IPs, so you can use it on remote machines. lsof is actually a tool which looks in the operating system and sees what processes are using what ports. – Lucas Kauffman Jul 3 '13 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.