3

I've made an scan to one single IP with nmap and it reports that the port 65301 is opened, and even it detects that it's maybe the service pcanywhere.

sudo nmap -p 65000-65535 -sV x.x.x.x
Starting Nmap 6.00 ( http://nmap.org ) at 2015-06-04 22:43 CEST
Nmap scan report for x.x.x.x
Host is up (0.96s latency).
Not shown: 336 closed ports
PORT      STATE SERVICE     VERSION
...
65003/tcp open  unknown
65301/tcp open  pcanywhere?
65308/tcp open  unknown
...

But when I try to establish a connection to that port with telnet, it just refuses the connection:

$ telnet  x.x.x.x 65301
Trying x.x.x. ...
telnet: Unable to connect to remote host: Connection refused

What may be the cause of the "connection refused": has nmap returned a false detection and the port isn't really opened? Or maybe there is some additional restriction that makes telnet not being able to connect though the port is opened?

The same happens with the other port with service "unknown", but that fact that thugh it has detected a possible service (pcanywhere) but telnet get connected intrigues me.

UPDATE: I attach the results of the execution of the command proposed by StackzOfZtuff, it detects the port as closed, which I think it's the normal behaviour (moreover the first command now reports the port as closed now):

$ sudo nmap -vv --packet-trace -p 65301 -sV x.x.x.x
...
Initiating SYN Stealth Scan at 10:24
Scanning x.x.x.x [1 port]
SENT (0.1877s) TCP y.y.y.y:53502 > x.x.x.x:65301 S ttl=53 id=3258 iplen=44  seq=3444593130 win=1024 <mss 1460>
RCVD (0.1881s) TCP x.x.x.x:36876 > y.y.y.y:41094 RA ttl=255 id=62429 iplen=40  seq=0 win=0 
RCVD (0.2064s) TCP x.x.x.x:21053 > y.y.y.y:41094 RA ttl=255 id=62430 iplen=40  seq=0 win=0 
RCVD (0.2084s) TCP x.x.x.x:42352 > y.y.y.y:41094 RA ttl=255 id=62431 iplen=40  seq=0 win=0 
RCVD (0.2110s) TCP x.x.x.x:4036 > y.y.y.y:41094 RA ttl=255 id=62432 iplen=40  seq=0 win=0 
RCVD (0.2308s) TCP x.x.x.x:30952 > y.y.y.y:41094 RA ttl=255 id=62433 iplen=40  seq=0 win=0 
RCVD (0.2352s) TCP x.x.x.x:65301 > y.y.y.y:53502 RA ttl=255 id=62434 iplen=40  seq=0 win=0 
Completed SYN Stealth Scan at 10:24, 0.05s elapsed (1 total ports)
Initiating Service scan at 10:24
NSE: Script scanning x.x.x.x.
NSE: Starting runlevel 1 (of 1) scan.
Nmap scan report for x.x.x.x
Host is up (0.0061s latency).
Scanned at 2015-06-06 10:24:17 CEST for 0s
PORT      STATE  SERVICE    VERSION
65301/tcp closed pcanywhere
2

It's possible that the device is only allowing connections from specified IP address ranges(ex:192.168.1.0/24 for it's local subnet). So while scanning it may show the port open and telnet running, unless it sees your IP address in that range, your connection will be refused.

  • 4
    Why would it receive a syn-ack if it isn't allowing the remote IP? – SilverlightFox Jun 6 '15 at 7:59
  • It may have very specific firewall rules that allow some traffic regardless of IP, then restricts certain traffic based on IP. Does that make sense? EX: Allow pings from everyone, but only SSH from a /24 network range. – RedLee Jun 9 '15 at 19:10
  • No, because then telnet would connect. – SilverlightFox Jun 9 '15 at 19:22
1

Weird. Try to scan that one port with increased verbosity to see what's going on.

sudo nmap -vv --packet-trace -p 65301 -sV x.x.x.x
0

From the packet-trace output, nmap sent a TCP SYN request [S] to port 65301. Nmap then received a response from 65301 with a Reset-Acknowledge [RA] -- it's acknowledging your Syn packet, then resetting the connection.

SENT (0.1877s) TCP y.y.y.y:53502 > x.x.x.x:65301 S ttl=53 id=3258 iplen=44  seq=3444593130 win=1024 <mss 1460>

RCVD (0.2352s) TCP x.x.x.x:65301 > y.y.y.y:53502 RA ttl=255 id=62434 iplen=40  seq=0 win=0 

You're getting a lot of stuff back on port 41094, so it would seem that this connection requires multiple-ports to work.

RCVD (0.1881s) TCP x.x.x.x:36876 > y.y.y.y:41094 RA ttl=255 id=62429 iplen=40  seq=0 win=0 
RCVD (0.2064s) TCP x.x.x.x:21053 > y.y.y.y:41094 RA ttl=255 id=62430 iplen=40  seq=0 win=0 
RCVD (0.2084s) TCP x.x.x.x:42352 > y.y.y.y:41094 RA ttl=255 id=62431 iplen=40  seq=0 win=0 
RCVD (0.2110s) TCP x.x.x.x:4036 > y.y.y.y:41094 RA ttl=255 id=62432 iplen=40  seq=0 win=0 
RCVD (0.2308s) TCP x.x.x.x:30952 > y.y.y.y:41094 RA ttl=255 id=62433 iplen=40  seq=0 win=0 

Since all of the connections comeback have [RA], these are also being reset. It's very likely that in order to properly establish the connection, you need to provide some initial data/cookie/header, something in order to establish communication.

This port is marked Open because you receive quite a bit of data in response to the SYN packet, but there's a missing piece in order to properly establish a communications channel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.