7

I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not).

What would help me to better understand them is a clear association to the flags returned by the host. Therefore I created the list below and would appreciate to have it doubled checked by you guys:

 State             Response

 Open              SYN/ACK (SYN probe)
 Closed            RST (SYN probe)
 Filtered          No Answer or ICMP Type 3 and 13 (SYN probe)
 Unfiltered        No Answer or ICMP Type 3 and 13 (ACK probe)
 Open/Filtered     No Answer (UDP, FIN, NULL, XMAS probes)
 Closed/Filtered   No Answer or RST (Idle Scan)
  • 7
    You can not getter better clarification than on the official documentation – user45139 Jul 29 '15 at 14:26
  • @begueradj I agree, however the documentation does not explicitly mention it... – user69377 Jul 30 '15 at 8:38
  • I have a copy of this book too. Can you clarify your question a bit? I'd like to help you out but I'm not sure exactly what type of answer you're looking for. "What would help me to better understand them is a clear association to the flags returned by the host." The way I understand your question; that State & Response table is the best answer. So what more would you like to know? – voices Oct 10 '15 at 15:40
8
+250
  1. Open:

    • The attacker sends a SYN probe to the port he wants to test
    • The port sends back a packet with SYN and ACK flags
  2. Closed:

    • The attacker sends a SYN probe to the port he wants to test
    • The port sends back RST/ACK packet directly
  3. Filtered:

    • The attacker sends a SYN probe to the port he wants to test
    • Two scenarios:
      • The port responds back with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited)
      • More frustrating scenario for the attacker: the SYN probe is dropped (no answer at all)
  4. Unfiltered:
    • The attacker sends a ACK probe to the port he wants to test
    • The port responds with RST packet
  5. Open/Filtered:
    • The attacker sends a UDP, IP, FIN, NULL or Xmas probes to the port he wants to test
    • No answer is received
  6. Closed/Filtered:
    • The attacker performs an idle scan (-sI)
    • The zombie machine receives RST packet, or nothing at all from the target machine (this means the attacker will receive IPID=1 from the zombie)
  • Unfiltered: "Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state": nmap.org/book/man-port-scanning-basics.html – Michael Oct 8 '15 at 6:24
  • 1
    @Michael Yes, you are right: it was just a typo as I copy/past the phrase: The attacker sends a SYN probe to the port he wants to test. I had to rectify it right away after the copy/past but I forgot .Than you for paying attention – user45139 Oct 8 '15 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy