3

I'm running a basic scan using nmap from

1) a VM of Kali Linux running on personal machine

2) an instance of Amazon Linux, running on Amazon's EC2 cloud

These two runs (against any target) are producing vastly different results, with the personal Kali run always producing much more and more detailed results (more IPs found, more ports in each IP). Does anyone have any explanation for this? I think that something in the cloud setup is affecting the scan. I have also tried running scan from Kali in cloud and nothing changed, so it isn't Kali vs non-Kali that is affecting results. My security group for my EC2 instance is configured to allow all inbound and outbound traffic. My instance is running on VPC, not classic, and I don't know if possibly there is a NAT or something intercepting the traffic but I don't think so. Also, I have received permission from Amazon and all targets of my scans to conduct this testing. Any input is appreciated. Thanks

EDIT: Here is verbose output from 1) Kali scan and 2) EC2 scan

  • 1
    A complete verbose (-v) output of a scan from your EC2 instance would be quite helpful in figuring out what's happening. – Mark Nov 28 '14 at 23:14
  • Can you edit your question to include sanitized command you're running on both? Consider that EC2 might be blocking some traffic out (or in) as suspicious. – schroeder Nov 29 '14 at 0:39
1

There are a number of differences between your EC2 scan and your Kali scan:

  1. Most significantly, your Kali scan is performing a SYN scan (start to open a connection, listen for an "ACK" packet, then abandon it), while your EC2 scan is performing a Connect scan (fully open a TCP connection, then shut it down cleanly). Try a Kali scan in Connect mode (nmap -sT) to see if the results change.

  2. Your EC2 scan is using version 5.51 while your Kali scan is using version 6.47. This shouldn't make a difference for a simple "open ports" scan, but the older version won't have the same software and OS version detection that the newer one does.

  3. Your Kali scan shows dropped probes, meaning there's traffic congestion or a firewall between you and scanme.nmap.org. This shouldn't be causing false "open" results, though it can cause false "filtered" results.

My suspicion is that something is going wrong with your Kali scans, since my results for scanme.nmap.org are identical to your EC2 results.

  • Here is Kali connect mode scan. Would that mean that the Kali scan is turning up false positives? Also, do you know anything about the effect a NAT may have on the EC2 scan? My sysadmin said that he thinks our instances are behind a NAT, which may be affecting things. You said your results were identical to my EC2 - were you scanning from EC2 as well? – Landon Nov 29 '14 at 3:26
  • I'm scanning from two locations, one of which I know has an unrestricted connection to the Internet. Properly-functioning NAT shouldn't have any impact on nmap scan results; I'm not aware of any NAT failure mode that would generate false positives on a Connect scan. I'm thinking your Kali scan may be running into transparent port redirection by your ISP, as all the apparent false positives on Kali are related to NNTP or email. What happens if you run telnet scanme.nmap.org 25? – Mark Nov 29 '14 at 7:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.