Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration:
- All ICMP traffic is blocked
- An IDS or some device returns all ports as filtered when scanning with nmap, using sT, sN and sS scans.
- Even running at -T0 or -T1, any port is returned as filtered. Scanning a single port, eg -p 65544 before doing a full scan shows it as filtered also.
Only a very small percentage of hosts will seem to be actually up, i.e. having a port accessible on the server.
The problem with the IDS reporting many ports as "filtered" for a host means nmap considers it live.
Sometimes I run into this problem with very very large ranges. Determining the amount of live hosts can save time on the assessment, and so I am looking for a way to automate in some fashion.
If the only answer to to only use hosts that have at least one port as "open", is there a way to script nmap to ignore ports considered "filtered"?
I should also note, ARP is not an option here due to this being an external scan across the internet, and there is no pivot point.