6

Say you're curious or doing port-hardening, you'd be curious what those most common ports are. Short of opening the file & sorting, is there a command to show those ports? Another way that MAY please the desire is a command to show all ports scanned regardless of state (closed/filterd/etc)

Homework I did: did some googling & searching on this site. Quickly read over the nmap documentation. Tried scanning ports & it seems to start grouping (Not shown: 991 closed ports) around 29/30. Found the page below (not enough rep to post links) that seems to elude there was a function (probably in the nmap source) for gettoppts/getpts, then advises of a database sorted_services (maybe that's a file in the nmap directory)

www.bamsoftware.com/wiki/Nmap/TopPortsReview

  • If you are interested in doing hardening, you should be whitelisting specific ports you need open, instead of scanning with nmap, checking the results, and changing your configuration that way. – user11869 Jan 7 '15 at 16:58
  • Thanks for the tip. However that was just an example, I am currently in the 'curious' phase – gregg Jan 7 '15 at 18:23
8

In addition to sorting the nmap-services file as SilverlightFox suggests, you can get this information from Nmap:

$ ./nmap --top-ports 1000 localhost -v -oG -
# Nmap 6.47SVN scan initiated Wed Jan  7 18:04:53 2015 as: ./nmap --top-ports 1000 -v -oG - localhost
# Ports scanned: TCP(1000;1,3-4,6-7,9,13,17,19-26,30,32-33,37,42-43,49,53,70,79-85,88-90,99-100,106,109-111,113,119,125,135,139,143-144,146,161,163,179,199,211-212,222,254-256,259,264,280,301,306,311,340,366,389,406-407,416-417,425,427,443-445,458,464-465,481,497,500,512-515,524,541,543-545,548,554-555,563,587,593,616-617,625,631,636,646,648,666-668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800-801,808,843,873,880,888,898,900-903,911-912,981,987,990,992-993,995,999-1002,1007,1009-1011,1021-1100,1102,1104-1108,1110-1114,1117,1119,1121-1124,1126,1130-1132,1137-1138,1141,1145,1147-1149,1151-1152,1154,1163-1166,1169,1174-1175,1183,1185-1187,1192,1198-1199,1201,1213,1216-1218,1233-1234,1236,1244,1247-1248,1259,1271-1272,1277,1287,1296,1300-1301,1309-1311,1322,1328,1334,1352,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687-1688,1700,1717-1721,1723,1755,1761,1782-1783,1801,1805,1812,1839-1840,1862-1864,1875,1900,1914,1935,1947,1971-1972,1974,1984,1998-2010,2013,2020-2022,2030,2033-2035,2038,2040-2043,2045-2049,2065,2068,2099-2100,2103,2105-2107,2111,2119,2121,2126,2135,2144,2160-2161,2170,2179,2190-2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381-2383,2393-2394,2399,2401,2492,2500,2522,2525,2557,2601-2602,2604-2605,2607-2608,2638,2701-2702,2710,2717-2718,2725,2800,2809,2811,2869,2875,2909-2910,2920,2967-2968,2998,3000-3001,3003,3005-3007,3011,3013,3017,3030-3031,3052,3071,3077,3128,3168,3211,3221,3260-3261,3268-3269,3283,3300-3301,3306,3322-3325,3333,3351,3367,3369-3372,3389-3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689-3690,3703,3737,3766,3784,3800-3801,3809,3814,3826-3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000-4006,4045,4111,4125-4126,4129,4224,4242,4279,4321,4343,4443-4446,4449,4550,4567,4662,4848,4899-4900,4998,5000-5004,5009,5030,5033,5050-5051,5054,5060-5061,5080,5087,5100-5102,5120,5190,5200,5214,5221-5222,5225-5226,5269,5280,5298,5357,5405,5414,5431-5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678-5679,5718,5730,5800-5802,5810-5811,5815,5822,5825,5850,5859,5862,5877,5900-5904,5906-5907,5910-5911,5915,5922,5925,5950,5952,5959-5963,5987-5989,5998-6007,6009,6025,6059,6100-6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565-6567,6580,6646,6666-6669,6689,6692,6699,6779,6788-6789,6792,6839,6881,6901,6969,7000-7002,7004,7007,7019,7025,7070,7100,7103,7106,7200-7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777-7778,7800,7911,7920-7921,7937-7938,7999-8002,8007-8011,8021-8022,8031,8042,8045,8080-8090,8093,8099-8100,8180-8181,8192-8194,8200,8222,8254,8290-8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651-8652,8654,8701,8800,8873,8888,8899,8994,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9099-9103,9110-9111,9200,9207,9220,9290,9415,9418,9485,9500,9502-9503,9535,9575,9593-9595,9618,9666,9876-9878,9898,9900,9917,9929,9943-9944,9968,9998-10004,10009-10010,10012,10024-10025,10082,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,11110-11111,11967,12000,12174,12265,12345,13456,13722,13782-13783,14000,14238,14441-14442,15000,15002-15004,15660,15742,16000-16001,16012,16016,16018,16080,16113,16992-16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221-20222,20828,21571,22939,23502,24444,24800,25734-25735,26214,27000,27352-27353,27355-27356,27715,28201,30000,30718,30951,31038,31337,32768-32785,33354,33899,34571-34573,35500,38292,40193,40911,41511,42510,44176,44442-44443,44501,45100,48080,49152-49161,49163,49165,49167,49175-49176,49400,49999-50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055-55056,55555,55600,56737-56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389) UDP(0;) SCTP(0;) PROTOCOLS(0;)
Host: 127.0.0.1 (localhost)     Status: Up
Host: 127.0.0.1 (localhost)     Ports: 22/open/tcp//ssh///, 25/open/tcp//smtp///, 80/open/tcp//http///, 1080/open/tcp//socks///, 5432/open/tcp//postgresql///   Ignored State: closed (995)
# Nmap done at Wed Jan  7 18:04:53 2015 -- 1 IP address (1 host up) scanned in 0.10 seconds

Using the -oG - (greppable output to stdout) and -v (verbose) options, you can get a complete list of all the ports Nmap scanned (see the second line of output, beginning with # Ports scanned:). Unfortunately, you also need to do a port scan at the same time, so I used localhost to scan my own machine (usually much faster than any network scan will be). This is also useful for more complicated cases like nmap -sSU --port-ratio .2 (3 TCP and 10 UDP ports).

EDIT: Based on comments below, it looks like you might just want a full, verbose output of all ports and their states for every host scanned. You can get this with -d3 or higher debug levels.

EDIT 2: Recently discovered that localhost in this command is unnecessary. You can run the exact same command without specifying any targets, which will fail with a warning but still produce the "Ports scanned" output line: ./nmap --top-ports 1000 -v -oG -

  • I think you nailed my primary question best. Leave it to me (I over think things) to not try verbose. Scanning localhost got me the ports I was looking for, however it still grouped them when scanning a remote server. This now falls into 'how to show all ports scanned regardless of state'; I'd be curious if you had an answer :) – gregg Jan 7 '15 at 18:33
  • @gregg See the second line of output, # Ports scanned:. It has a list of all scanned ports, regardless of state. Edit to answer coming for another aspect of your question... – bonsaiviking Jan 7 '15 at 18:41
  • You are correct. I was omitting the -oG as the output was all jumbled together & I thought you had included that because you personally like to do additional processing in grep. I was also confused about the additional dash, its telling it to output to stdout (screen) instead of a file; see (search for hypen) nmap.org/book/man-output.html – gregg Jan 7 '15 at 19:32
  • @gregg Thanks for the feedback. I clarified my answer, too. – bonsaiviking Jan 7 '15 at 19:48
9

sort -r -k3 /usr/share/nmap/nmap-services should give you what you need.

This will sort the nmap-services file by open-frequency.

http    80/tcp  0.484143    # World Wide Web HTTP
ipp 631/udp 0.450281    # Internet Printing Protocol
snmp    161/udp 0.433467    # Simple Net Mgmt Proto
netbios-ns  137/udp 0.365163    # NETBIOS Name Service
ntp 123/udp 0.330879    # Network Time Protocol
netbios-dgm 138/udp 0.297830    # NETBIOS Datagram Service
ms-sql-m    1434/udp    0.293184    # Microsoft-SQL-Monitor
microsoft-ds    445/udp 0.253118
msrpc   135/udp 0.244452    # Microsoft RPC services
dhcps   67/udp  0.228010    # DHCP/Bootstrap Protocol Server
telnet  23/tcp  0.221265
domain  53/udp  0.213496    # Domain Name Server
https   443/tcp 0.208669    # secure http (SSL)
ftp 21/tcp  0.197667    # File Transfer [Control]
netbios-ssn 139/udp 0.193726    # NETBIOS Session Service
ssh 22/tcp  0.182286    # Secure Shell Login
...
  • Got any magic for windows (short of cygwin)? Their switch /+# is character based & the whitespace/tabbing in the file throws it off – gregg Jan 7 '15 at 18:23
5

Easiest way is:

nmap -oX - --top-ports 1000 x

This will print the XML output to the terminal which includes the exact ports. You don't need to specify a real host list either.

1

I prefer awk '$2~/tcp$/' /usr/share/nmap/nmap-services | sort -r -k3 | head -n 100 because I scan TCP separately from UDP.

E.g.,

nmap --script banner -iL block --min-rate 10 --min-parallelism 20 --defeat-rst-ratelimit -n -Pn -g 88 -p-
nmap -iL block --min-rate 450 --min-parallelism 20 -n -Pn -sUV --version-all -g 53 -p-

I'd replace the -p- with the specific ports you are looking to test.

In order to verify other characteristics, especially for found TCP ports, I'd likely next try:

nmap --script qscan -iL block -v -O --osscan-guess --max-os-tries 1 -n -Pn -sV -p-
nmap --script firewalk --traceroute -iL block -n -Pn -p-
nmap --script firewalk --traceroute -iL block -n -Pn -p- --data-length 100
nmap --script firewall-bypass -iL block -n -Pn -p-

Again, replacing -p- with more-specific ports and following with bnat-suite (search msfconsole for bnat or check out its GitHub page), fragroute, osstmm-afd, 0trace, etc for a complete analysis of firewall/IPS.

--reason will show all states for either TCP or UDP.

There is a lot more you can do with nmap or otherwise, but I'm keeping this conversation to layer 4 which may or may not be an oversimplification.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.