2

I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this?

Is it possible that the firewall is just dropping NMap's type of ping packets but would respond to a normal connection in telnet or a web browser?

I've searched a lot, but couldn't find any specific information on this (Maybe I was using the wrong keywords? I'm not sure)

Thanks!

  • Repeat question -- security.stackexchange.com/questions/53104/… – atdre May 22 '15 at 1:37
  • @atdre I saw that question, but it seemed different. I understand that the firewall may drop the ping and an exploitation attempt, but would it drop a normal connection attempt, like connecting through HTTP? – cybersec May 22 '15 at 1:39
  • @cybersec firewalls can drop for a variety of reasons – schroeder May 22 '15 at 2:04
3

Seeing a 'filtered' state for a port has nothing to do with a "ping" or an exploitation attempt. Nmap's traffic is generally not exploitative. An adaptive firewall could detect the default (with privileges) half-open SYN scan after it has detected an open port, or it could detect any of it scan types based on the number of closed ports it tries to connect to. But most firewalls will not do this.

Using the --reason option, you can see the type of response that caused a port to be in the state it is. Most of the time, 'filtered' means that all the probes to that port timed out, and no response was seen. Sometimes, though, it can be because an ICMP Administratively Prohibited message was received. This is a good indication that a more-intelligent firewall is in place.

In the most common case, however, a filtered port simply means that a static (i.e. not adaptive) firewall has been configured to drop connections to that port. In this case, any incoming connection, whether Nmap or telnet or a browser, will be dropped.

2

The standard scan method (TCP SYN) used by nmap for TCP scans is to start opening a connection, then abandon it halfway through. Individually, these connections are indistinguishable from an ordinary connection. Collectively, they can be identified because of how many of them there are, but it takes a while for the evidence to build up and the firewall to decide to block all connections from a given address. This typically shows up as early ports in the scan being "open" or "closed", while later ports are "filtered".

This can be circumvented in three ways: first, by reducing the rate at which ports are probed (-T0 makes one probe every five minutes), second, by limiting the number of probes (if you're only interested in checking for a webserver, for example, you might probe only ports 80 and 443), and third, by probing from many different addresses so that no one address goes over the firewall's threshold for blocking.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.