Ports Showing Closed/Filtered in Nmap ScansWhy does an nmap -sT scan show ports filtered but -sS shows ports closedFirewalk through a Firewall on our subnetnmap OS scan showing DD-WRT when I'm not running it?What are the security implications of allowing all incoming connections in a firewall on a typical Windows server?Samba open ports, not being filteredSorting hosts via open ports using NMapNMAP - Closed vs Filterednmap not showing closed ports
Can a Creature at 0 HP Take Damage?
Are there any privately owned large commercial airports?
Do "chess engine in the cloud" services exist?
There is any way today to recover/dump 2M disks?
'Cheddar goes "good" with burgers?' Can "go" be seen as a verb of the senses?
Why is the logical NOT operator in C-style languages "!" and not "~~"?
how do you value what your leisure time is worth?
How do lasers measure short distances (<1cm) when electronics are too slow for time-of-flight to work?
Reduction of carbamate with LAH
Is having your hand in your pocket during a presentation bad?
one-liner vs script
Meaning of A-infinity relations
What ways are there to bypass spell resistance?
Why does unique_ptr<Derived> implicitly cast to unique_ptr<Base>?
Why do previous versions of Debian packages vanish in the package repositories? (highly relevant for version-controlled system configuration)
Low-magic medieval fantasy clothes that allow the wearer to grow?
Conveying the idea of " judge a book by its cover" by " juger un livre par sa couverture"
This fell out of my toilet when I unscrewed the supply line. What is it?
Finger Picking Chords - Beats per bar
Would it be easier to colonise a living world or a dead world?
Is It normal to keep log file larger than data file?
How to copy the path of current directory in ubuntu 18.04
Sanitise a high score table
Solving a Certainty Equivalent (Decision Analysis) problem
Ports Showing Closed/Filtered in Nmap Scans
Why does an nmap -sT scan show ports filtered but -sS shows ports closedFirewalk through a Firewall on our subnetnmap OS scan showing DD-WRT when I'm not running it?What are the security implications of allowing all incoming connections in a firewall on a typical Windows server?Samba open ports, not being filteredSorting hosts via open ports using NMapNMAP - Closed vs Filterednmap not showing closed ports
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;
hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other nmap switches such as zombie scans etc? I specified all ports in my scan using -p- .My thought is that it would show a large list of all closed ports on my system not just those?
Here is the command I ran: nmap -iL axisips.txt -A -sV -p- > axisnmapresults2.txt
Host is up (0.062s latency).
Not shown: 65525 filtered ports
PORT STATE SERVICE VERSION
17/tcp closed qotd
19/tcp closed chargen
25/tcp closed smtp
111/tcp closed rpcbind
136/tcp closed profile
137/tcp closed netbios-ns
138/tcp closed netbios-dgm
139/tcp closed netbios-ssn
443/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
firewalls nmap ports port-knocking
asked Apr 17 at 14:47
john_zombiejohn_zombie
902 silver badges11 bronze badges
add a comment
|
hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other nmap switches such as zombie scans etc? I specified all ports in my scan using -p- .My thought is that it would show a large list of all closed ports on my system not just those?
Here is the command I ran: nmap -iL axisips.txt -A -sV -p- > axisnmapresults2.txt
Host is up (0.062s latency).
Not shown: 65525 filtered ports
PORT STATE SERVICE VERSION
17/tcp closed qotd
19/tcp closed chargen
25/tcp closed smtp
111/tcp closed rpcbind
136/tcp closed profile
137/tcp closed netbios-ns
138/tcp closed netbios-dgm
139/tcp closed netbios-ssn
443/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
firewalls nmap ports port-knocking
asked Apr 17 at 14:47
john_zombiejohn_zombie
902 silver badges11 bronze badges
what were the port nos?
– JOW
Apr 17 at 16:22
1
Added in Original post
– john_zombie
Apr 17 at 16:40
add a comment
|
hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other nmap switches such as zombie scans etc? I specified all ports in my scan using -p- .My thought is that it would show a large list of all closed ports on my system not just those?
Here is the command I ran: nmap -iL axisips.txt -A -sV -p- > axisnmapresults2.txt
Host is up (0.062s latency).
Not shown: 65525 filtered ports
PORT STATE SERVICE VERSION
17/tcp closed qotd
19/tcp closed chargen
25/tcp closed smtp
111/tcp closed rpcbind
136/tcp closed profile
137/tcp closed netbios-ns
138/tcp closed netbios-dgm
139/tcp closed netbios-ssn
443/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
firewalls nmap ports port-knocking
asked Apr 17 at 14:47
john_zombiejohn_zombie
902 silver badges11 bronze badges
hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other nmap switches such as zombie scans etc? I specified all ports in my scan using -p- .My thought is that it would show a large list of all closed ports on my system not just those?
Here is the command I ran: nmap -iL axisips.txt -A -sV -p- > axisnmapresults2.txt
Host is up (0.062s latency).
Not shown: 65525 filtered ports
PORT STATE SERVICE VERSION
17/tcp closed qotd
19/tcp closed chargen
25/tcp closed smtp
111/tcp closed rpcbind
136/tcp closed profile
137/tcp closed netbios-ns
138/tcp closed netbios-dgm
139/tcp closed netbios-ssn
443/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
firewalls nmap ports port-knocking
firewalls nmap ports port-knocking
asked Apr 17 at 14:47
john_zombiejohn_zombie
902 silver badges11 bronze badges
asked Apr 17 at 14:47
john_zombiejohn_zombie
902 silver badges11 bronze badges
edited Apr 17 at 16:43
john_zombie
asked Apr 17 at 14:47
john_zombiejohn_zombie
902 silver badges11 bronze badges
asked Apr 17 at 14:47
john_zombiejohn_zombie
902 silver badges11 bronze badges
asked Apr 17 at 14:47
john_zombiejohn_zombie
902 silver badges11 bronze badges
902 silver badges11 bronze badges
what were the port nos?
– JOW
Apr 17 at 16:22
1
Added in Original post
– john_zombie
Apr 17 at 16:40
add a comment
|
what were the port nos?
– JOW
Apr 17 at 16:22
1
Added in Original post
– john_zombie
Apr 17 at 16:40
what were the port nos?
– JOW
Apr 17 at 16:22
what were the port nos?
– JOW
Apr 17 at 16:22
1
1
Added in Original post
– john_zombie
Apr 17 at 16:40
Added in Original post
– john_zombie
Apr 17 at 16:40
add a comment
|
1 Answer
1
active
oldest
votes
To avoid 65K+ lines of mostly-useless output, Nmap collapses most "uninteresting" results into a line that says something like "Not shown: 65530 filtered ports." Open ports are never collapsed this way, but closed (TCP RST) and filtered (no response or ICMP admin-prohibited) ports are only shown if there are fewer than a certain number.
In your case, I would guess that most of the ports are "filtered" but a few are "closed" instead. There are many reasons this might be the case, but the most likely are:
- Something between you and the target is blocking access to those ports by spoofing RST replies. This is common with residential ISPs blocking ports 137, 139, and 445, among others.
- The target's firewall is allowing those ports, but there is no service running on them.
EDITED TO ADD: Based on the actual port output, I'm pretty sure this is ISP filtering (spoofing closed-port responses). Ports 17 and 19 are commonly used as DDoS amplifiers (though UDP, not TCP). Ports 137-139 and 445 have been exploited on Windows by network worms. Port 25 is for email servers, so ISPs block it unless you buy a business-class connection. I'm not sure about 111 and 136; those could be legitimately closed, or they could be blocked for some other reason. Add the --reason option to your scan to see details about IP Time-to-Live (TTL) in the response; abnormally high TTL values can indicate ISP blocking, especially if the TTL value for open ports is several hops lower (usually between 5 and 15 hops different or so).
answered Apr 17 at 16:36
bonsaivikingbonsaiviking
9,7711 gold badge21 silver badges44 bronze badges
So just because its showing closed it means its not running but available?
– john_zombie
Apr 17 at 16:44
@john_zombie Basically yes. A "port" is just an address, a number on a packet. A process on a machine can "listen" on the port, which means it tells the OS, "when a connection comes in with this port number, give it to me." When that happens, the port is "open." If no process has asked for a particular number, then a probe to that port will be rejected ("closed"). The firewall inspects connections before any of this and may drop or reject connections regardless of whether a process wants them. So "filtered" means "could be open or closed, but you can't use it anyway."
– bonsaiviking
Apr 17 at 16:55
So not much I can really do with these ports then? Would it be best practice to hide them from scans?
– john_zombie
Apr 19 at 13:31
add a comment
|
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "162"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f207605%2fports-showing-closed-filtered-in-nmap-scans%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
To avoid 65K+ lines of mostly-useless output, Nmap collapses most "uninteresting" results into a line that says something like "Not shown: 65530 filtered ports." Open ports are never collapsed this way, but closed (TCP RST) and filtered (no response or ICMP admin-prohibited) ports are only shown if there are fewer than a certain number.
In your case, I would guess that most of the ports are "filtered" but a few are "closed" instead. There are many reasons this might be the case, but the most likely are:
- Something between you and the target is blocking access to those ports by spoofing RST replies. This is common with residential ISPs blocking ports 137, 139, and 445, among others.
- The target's firewall is allowing those ports, but there is no service running on them.
EDITED TO ADD: Based on the actual port output, I'm pretty sure this is ISP filtering (spoofing closed-port responses). Ports 17 and 19 are commonly used as DDoS amplifiers (though UDP, not TCP). Ports 137-139 and 445 have been exploited on Windows by network worms. Port 25 is for email servers, so ISPs block it unless you buy a business-class connection. I'm not sure about 111 and 136; those could be legitimately closed, or they could be blocked for some other reason. Add the --reason option to your scan to see details about IP Time-to-Live (TTL) in the response; abnormally high TTL values can indicate ISP blocking, especially if the TTL value for open ports is several hops lower (usually between 5 and 15 hops different or so).
answered Apr 17 at 16:36
bonsaivikingbonsaiviking
9,7711 gold badge21 silver badges44 bronze badges
So just because its showing closed it means its not running but available?
– john_zombie
Apr 17 at 16:44
@john_zombie Basically yes. A "port" is just an address, a number on a packet. A process on a machine can "listen" on the port, which means it tells the OS, "when a connection comes in with this port number, give it to me." When that happens, the port is "open." If no process has asked for a particular number, then a probe to that port will be rejected ("closed"). The firewall inspects connections before any of this and may drop or reject connections regardless of whether a process wants them. So "filtered" means "could be open or closed, but you can't use it anyway."
– bonsaiviking
Apr 17 at 16:55
So not much I can really do with these ports then? Would it be best practice to hide them from scans?
– john_zombie
Apr 19 at 13:31
add a comment
|
To avoid 65K+ lines of mostly-useless output, Nmap collapses most "uninteresting" results into a line that says something like "Not shown: 65530 filtered ports." Open ports are never collapsed this way, but closed (TCP RST) and filtered (no response or ICMP admin-prohibited) ports are only shown if there are fewer than a certain number.
In your case, I would guess that most of the ports are "filtered" but a few are "closed" instead. There are many reasons this might be the case, but the most likely are:
- Something between you and the target is blocking access to those ports by spoofing RST replies. This is common with residential ISPs blocking ports 137, 139, and 445, among others.
- The target's firewall is allowing those ports, but there is no service running on them.
EDITED TO ADD: Based on the actual port output, I'm pretty sure this is ISP filtering (spoofing closed-port responses). Ports 17 and 19 are commonly used as DDoS amplifiers (though UDP, not TCP). Ports 137-139 and 445 have been exploited on Windows by network worms. Port 25 is for email servers, so ISPs block it unless you buy a business-class connection. I'm not sure about 111 and 136; those could be legitimately closed, or they could be blocked for some other reason. Add the --reason option to your scan to see details about IP Time-to-Live (TTL) in the response; abnormally high TTL values can indicate ISP blocking, especially if the TTL value for open ports is several hops lower (usually between 5 and 15 hops different or so).
answered Apr 17 at 16:36
bonsaivikingbonsaiviking
9,7711 gold badge21 silver badges44 bronze badges
So just because its showing closed it means its not running but available?
– john_zombie
Apr 17 at 16:44
@john_zombie Basically yes. A "port" is just an address, a number on a packet. A process on a machine can "listen" on the port, which means it tells the OS, "when a connection comes in with this port number, give it to me." When that happens, the port is "open." If no process has asked for a particular number, then a probe to that port will be rejected ("closed"). The firewall inspects connections before any of this and may drop or reject connections regardless of whether a process wants them. So "filtered" means "could be open or closed, but you can't use it anyway."
– bonsaiviking
Apr 17 at 16:55
So not much I can really do with these ports then? Would it be best practice to hide them from scans?
– john_zombie
Apr 19 at 13:31
add a comment
|
To avoid 65K+ lines of mostly-useless output, Nmap collapses most "uninteresting" results into a line that says something like "Not shown: 65530 filtered ports." Open ports are never collapsed this way, but closed (TCP RST) and filtered (no response or ICMP admin-prohibited) ports are only shown if there are fewer than a certain number.
In your case, I would guess that most of the ports are "filtered" but a few are "closed" instead. There are many reasons this might be the case, but the most likely are:
- Something between you and the target is blocking access to those ports by spoofing RST replies. This is common with residential ISPs blocking ports 137, 139, and 445, among others.
- The target's firewall is allowing those ports, but there is no service running on them.
EDITED TO ADD: Based on the actual port output, I'm pretty sure this is ISP filtering (spoofing closed-port responses). Ports 17 and 19 are commonly used as DDoS amplifiers (though UDP, not TCP). Ports 137-139 and 445 have been exploited on Windows by network worms. Port 25 is for email servers, so ISPs block it unless you buy a business-class connection. I'm not sure about 111 and 136; those could be legitimately closed, or they could be blocked for some other reason. Add the --reason option to your scan to see details about IP Time-to-Live (TTL) in the response; abnormally high TTL values can indicate ISP blocking, especially if the TTL value for open ports is several hops lower (usually between 5 and 15 hops different or so).
answered Apr 17 at 16:36
bonsaivikingbonsaiviking
9,7711 gold badge21 silver badges44 bronze badges
To avoid 65K+ lines of mostly-useless output, Nmap collapses most "uninteresting" results into a line that says something like "Not shown: 65530 filtered ports." Open ports are never collapsed this way, but closed (TCP RST) and filtered (no response or ICMP admin-prohibited) ports are only shown if there are fewer than a certain number.
In your case, I would guess that most of the ports are "filtered" but a few are "closed" instead. There are many reasons this might be the case, but the most likely are:
- Something between you and the target is blocking access to those ports by spoofing RST replies. This is common with residential ISPs blocking ports 137, 139, and 445, among others.
- The target's firewall is allowing those ports, but there is no service running on them.
EDITED TO ADD: Based on the actual port output, I'm pretty sure this is ISP filtering (spoofing closed-port responses). Ports 17 and 19 are commonly used as DDoS amplifiers (though UDP, not TCP). Ports 137-139 and 445 have been exploited on Windows by network worms. Port 25 is for email servers, so ISPs block it unless you buy a business-class connection. I'm not sure about 111 and 136; those could be legitimately closed, or they could be blocked for some other reason. Add the --reason option to your scan to see details about IP Time-to-Live (TTL) in the response; abnormally high TTL values can indicate ISP blocking, especially if the TTL value for open ports is several hops lower (usually between 5 and 15 hops different or so).
answered Apr 17 at 16:36
bonsaivikingbonsaiviking
9,7711 gold badge21 silver badges44 bronze badges
edited Apr 17 at 17:03
answered Apr 17 at 16:36
bonsaivikingbonsaiviking
9,7711 gold badge21 silver badges44 bronze badges
answered Apr 17 at 16:36
bonsaivikingbonsaiviking
9,7711 gold badge21 silver badges44 bronze badges
answered Apr 17 at 16:36
bonsaivikingbonsaiviking
9,7711 gold badge21 silver badges44 bronze badges
9,7711 gold badge21 silver badges44 bronze badges
So just because its showing closed it means its not running but available?
– john_zombie
Apr 17 at 16:44
@john_zombie Basically yes. A "port" is just an address, a number on a packet. A process on a machine can "listen" on the port, which means it tells the OS, "when a connection comes in with this port number, give it to me." When that happens, the port is "open." If no process has asked for a particular number, then a probe to that port will be rejected ("closed"). The firewall inspects connections before any of this and may drop or reject connections regardless of whether a process wants them. So "filtered" means "could be open or closed, but you can't use it anyway."
– bonsaiviking
Apr 17 at 16:55
So not much I can really do with these ports then? Would it be best practice to hide them from scans?
– john_zombie
Apr 19 at 13:31
add a comment
|
So just because its showing closed it means its not running but available?
– john_zombie
Apr 17 at 16:44
@john_zombie Basically yes. A "port" is just an address, a number on a packet. A process on a machine can "listen" on the port, which means it tells the OS, "when a connection comes in with this port number, give it to me." When that happens, the port is "open." If no process has asked for a particular number, then a probe to that port will be rejected ("closed"). The firewall inspects connections before any of this and may drop or reject connections regardless of whether a process wants them. So "filtered" means "could be open or closed, but you can't use it anyway."
– bonsaiviking
Apr 17 at 16:55
So not much I can really do with these ports then? Would it be best practice to hide them from scans?
– john_zombie
Apr 19 at 13:31
So just because its showing closed it means its not running but available?
– john_zombie
Apr 17 at 16:44
So just because its showing closed it means its not running but available?
– john_zombie
Apr 17 at 16:44
@john_zombie Basically yes. A "port" is just an address, a number on a packet. A process on a machine can "listen" on the port, which means it tells the OS, "when a connection comes in with this port number, give it to me." When that happens, the port is "open." If no process has asked for a particular number, then a probe to that port will be rejected ("closed"). The firewall inspects connections before any of this and may drop or reject connections regardless of whether a process wants them. So "filtered" means "could be open or closed, but you can't use it anyway."
– bonsaiviking
Apr 17 at 16:55
@john_zombie Basically yes. A "port" is just an address, a number on a packet. A process on a machine can "listen" on the port, which means it tells the OS, "when a connection comes in with this port number, give it to me." When that happens, the port is "open." If no process has asked for a particular number, then a probe to that port will be rejected ("closed"). The firewall inspects connections before any of this and may drop or reject connections regardless of whether a process wants them. So "filtered" means "could be open or closed, but you can't use it anyway."
– bonsaiviking
Apr 17 at 16:55
So not much I can really do with these ports then? Would it be best practice to hide them from scans?
– john_zombie
Apr 19 at 13:31
So not much I can really do with these ports then? Would it be best practice to hide them from scans?
– john_zombie
Apr 19 at 13:31
add a comment
|
Thanks for contributing an answer to Information Security Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f207605%2fports-showing-closed-filtered-in-nmap-scans%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
what were the port nos?
– JOW
Apr 17 at 16:22
1
Added in Original post
– john_zombie
Apr 17 at 16:40