4

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN.

These ports are in the range 1024 through to 2500

That X54 computer is now gone and so there is nothing "listening" on those final destination ports

If I use scan the firewalls public IP using

nmap -A -p 1000-2500 219.xxx.xxx.xxx

Output

$ sudo nmap -A -p 1000-2500 219.xxx.xxx.xxx

Starting Nmap 6.40 ( http://nmap.org ) at 2015-02-21 13:14 NZDT
Nmap scan report for dsldevice.lan (219.xxx.xxx.xxx)
Host is up (0.011s latency).
Not shown: 1500 filtered ports
PORT     STATE SERVICE VERSION
1723/tcp open  pptp    THOMSON (Firmware: 1)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: broadband router
Running: Thomson embedded
OS CPE: cpe:/h:thomson:st_585 cpe:/h:thomson:st_536i
OS details: Thomson ST 585 or ST 536i ADSL modem
Network Distance: 1 hop
Service Info: Host: SpeedTouch

It reports other fully functioning - in this case 1723 - ports that are open and have a service listening, but doesn't show these ports that are forwarded to a non-existant machine.

So My question is, if nmap reports that a port is "open", does it mean that both the following is true?

  1. the firewall is accepting connections on the given port
  2. there is a machine/service listening on the other end
  • You've done service version scanning there (-A or -sV) and nmap has come back with THOMSON (Firmware: 1) - so this proves that your scanning computer can talk to the service in some way. However, this looks like it is a service on the router rather than a forwarded port. – SilverlightFox Feb 21 '15 at 13:16
6

For a SYN scan of the sort you are performing, nmap defines an "open" TCP port as one where a SYN packet sent by nmap elicits an ACK packet from the target system. Assuming that the firewall is configured sensibly, and that the TCP/IP stack is programmed correctly, an "open" port means that yes,

  1. the firewall is permitting connections on the given port
  2. there is a machine listening on the other end

and additionally

  1. there is software on the other end listening for data sent to that port.

If you want a greater degree of certainty, have nmap perform a "connect" scan (-sT). This is a slower technique that establishes a full TCP connection with the target, as opposed to the "halfway-opened" connection of a SYN scan. If a "connect" scan says the port is open, it's open in any meaningful sense of the word.

  • Ah, makes sense. So the ACK response packet is generated by the actual service e.g. mysql, ftp server etc and not the firewall? and therefore if there is no service, you wont even get a "halfway opened" connection/response – Michael Coleman Feb 21 '15 at 1:03
  • 1
    The ACK is generated by the target OS's networking stack if an actual service has registered that it is listening on that port; if no service is listening, a RST gets sent instead. The service itself doesn't get involved until the connection is fully established. – Mark Feb 21 '15 at 1:11
1
  1. Yes. Although there are situations where an ostensibly open port may not mean that you can communicate with it in a meaningful way.

  2. Not necessarily, like you just said, the firewall is waiting to forward those ports. Unless you have changed the firewall to no longer be waiting for data forward, it wont close the ports. You should see errors from this in your firewall logs.

Did you do service enumeration? It should be that NMAP can only guess at what is on the ports by the port numbers themselves. Look over exactly nmap was able to find, versus what it was guessing at. Run NMAP with a higher verbosity level.

You should probably close those ports.

  • thanks, so you are saying that nmap should be able to detect if a firewall port is open (i.e. accepting incoming connections on the port) even if there is nothing listening/on the other end? I just need to increase the sensitivity of nmap? I dont know what service enumeration is so I have just updated question to show nmap output – Michael Coleman Feb 21 '15 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.