Host & Port Scanning
After we know that the host is alive we want to scan the host for the following information:
Open ports and its services
Service versions
Information that the services provided
Operating system
Port States
The scanned ports returned by the nmap scan can be in a total of 6 different states:
open
This indicates that the connection to the scanned port has been established. These connections can be TCP connections, UDP datagrams as well as SCTP associations.
closed
When the port is shown as closed, the TCP protocol indicates that the packet we received back contains an RST flag. This scanning method can also be used to determine if our target is alive or not.
filtered
Nmap cannot correctly identify whether the scanned port is open or closed because either no response is returned from the target for the port or we get an error code from the target.
unfiltered
This state of a port only occurs during the TCP-ACK scan and means that the port is accessible, but it cannot be determined whether it is open or closed.
open|filtered
If we do not get a response for a specific port, Nmap will set it to that state. This indicates that a firewall or packet filter may protect the port.
closed|filtered
This state only occurs in the IP ID idle scans and indicates that it was impossible to determine if the scanned port is closed or filtered by a firewall.
TCP Ports
By default, if its run with root, nmap will scan the top 1000 TCP ports with SYN Scan -sS option as socket permissions are required to create raw TCP packets. Otherwise it will scan with TCP Connect Scan -sT option.
We can specify the ports range with -p option or --top-ports=10. We can also use fast port option -F to quickly scan the top 100 ports.
TCP Connect Scan option -sT, also knows as Full TCP Scan is more accurate as it finishes the whole three-way handshake. But its also the least stealthy method as most IDS/IPS systems can detect it. It's still important when accuracy is a priority. This scan is also useful when the host has a firewall that prevents incoming packets. But this scan is also slower as it waits for a response.
Filtered Ports
When a port is shows filtered there can be multiple reasons including firewalls on the hosts dropping the packets. By default nmap --max-retries is set to 10.
We can deactivate the ICMP echo requests (-Pn), DNS resolution (-n), and ARP ping scan (--disable-arp-ping) to check the results clearly
In this case we just get no reply. It is different when a firewall rejects the packets:
As a response, we receive an ICMP reply with type 3 and error code 3, which indicates that the desired port is unreachable. Nevertheless, if we know that the host is alive, we can strongly assume that the firewall on this port is rejecting the packets, and we will have to take a closer look at this port later.
UDP Ports
Unlike TCP, UDP is a stateless protocol. So there is no three-way handshake and no reply from the host. For that reason the timeout is much longer making UDP Scans (-sU) slower.
Another disadvantage of this is that we often do not get a response back because Nmap sends empty datagrams to the scanned UDP ports, and we do not receive any response. So we cannot determine if the UDP packet has arrived at all or not. If the UDP port is open, we only get a response if the application is configured to do so.
If we get an ICMP response with error code 3 (port unreachable), we know that the port is indeed closed.
Version Scan
Another useful scan option is -sV where nmap will get additional available information from the open ports such as service name, version, details about the service etc.
Last updated