I'm trying to find out what nmap-commands crash an embedded-system. In the process I can see behaviour that I don't understand:

On the system port 80 is open and 79 is closed.

  1. nmap -p 79-80 -T5 -A -> system crashes
  2. nmap -p 80 -T5 -A -> no crash and normal response

It doesn't matter which closed ports I add or remove from the range around the open port 80. As soon as I scan any port other than 80, the system crashes.

I'd be happy to hear some ideas why this could happen or some way to find out.

EDIT: The reason for this seems to be the timing-option -T5.

nmap -p 79-80 -T5 -A -> 79/tcp closed finger 80/tcp open http? 81/tcp closed

nmap -p 80 -T5 -A -> 80/tcp filtered http

nmap -p 80 -A -> 80/tcp open http? -> also crashes as expected!

  • Can you add a tcpdump of the scan with and without timing? – Dog eat cat world Oct 8 '14 at 18:11

if I am not mistaken, my theory... with the -A nmap is actually doing OS detection probes as well, one of the ways it identifies is through timing of probes sent to one open and one closed port. among a host of other things.

with a single port specified, I would bet that though typically this would be performed it is bypassed because you have specified only one port.

with any range of ports Id est 79-80, the feature would be utilized.

That is why it probably seems timing related as well, because of nmap choosing to do the best with what it was given based on request, because you certainly would not want it to say "Hey since you asked me to ID an OS, but only one port, I will probe another arbitrarily to honor the request"



It would happen because the start and end ports might be excluded by the nmap. You are giving the range 79-80 so when it exclude the start and end ports then there is no port to scan and you are explicitly mentioned the port option, which causes the crash. Give a try to

nmap -p 79-81 -T5 -A

  • I tried and it also crashed. The problem for me is that I don't understand why -p 80 does NOT crash. But thanks to you I had a closer look at the output with -vv and saw that with -p 80 it says: 80/tcp filtered http and with -p 79-81 it's open. I'll investigate that further and write as soon as i found out why. – dontWorrySirImFromTheInternetz Oct 8 '14 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.