Determing live hosts past a restrictive firewall with nmap

Question

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration:

• All ICMP traffic is blocked
• An IDS or some device returns all ports as filtered when scanning with nmap, using sT, sN and sS scans.
• Even running at -T0 or -T1, any port is returned as filtered. Scanning a single port, eg -p 65544 before doing a full scan shows it as filtered also.

Only a very small percentage of hosts will seem to be actually up, i.e. having a port accessible on the server.

The problem with the IDS reporting many ports as "filtered" for a host means nmap considers it live.

Sometimes I run into this problem with very very large ranges. Determining the amount of live hosts can save time on the assessment, and so I am looking for a way to automate in some fashion.

If the only answer to to only use hosts that have at least one port as "open", is there a way to script nmap to ignore ports considered "filtered"?

I should also note, ARP is not an option here due to this being an external scan across the internet, and there is no pivot point.

Answer 1

Have you tried using the --open option in nmap to show only open ports? It might be worth reading the nmap output man page.

Answer 2

"filtered" means that Nmap did not get any response back to a probe. A filtered port will never be used as proof that a host is up/live.

Nmap uses a decent set of probes by default to determine "liveness," but if you want to change them, you can use the options that start with -P.