4

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration:

  • All ICMP traffic is blocked
  • An IDS or some device returns all ports as filtered when scanning with nmap, using sT, sN and sS scans.
  • Even running at -T0 or -T1, any port is returned as filtered. Scanning a single port, eg -p 65544 before doing a full scan shows it as filtered also.

Only a very small percentage of hosts will seem to be actually up, i.e. having a port accessible on the server.

The problem with the IDS reporting many ports as "filtered" for a host means nmap considers it live.

Sometimes I run into this problem with very very large ranges. Determining the amount of live hosts can save time on the assessment, and so I am looking for a way to automate in some fashion.

If the only answer to to only use hosts that have at least one port as "open", is there a way to script nmap to ignore ports considered "filtered"?

I should also note, ARP is not an option here due to this being an external scan across the internet, and there is no pivot point.

2

Have you tried using the --open option in nmap to show only open ports? It might be worth reading the nmap output man page.

2

"filtered" means that Nmap did not get any response back to a probe. A filtered port will never be used as proof that a host is up/live.

Nmap uses a decent set of probes by default to determine "liveness," but if you want to change them, you can use the options that start with -P.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.