Security Basics mailing list archives
Re: AW: Re: nmap -sS SYN-SCAN does not find all open Ports?
From: "Arturas Zalenekas" <security () zalenekas net>
Date: Tue, 26 Sep 2006 22:20:02 -0500 (CDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi again, short answer: http://insecure.org/nmap/man/man-port-scanning-techniques.html http://www.rfc-editor.org/rfc/rfc793.txt These are BASIC information. You have to know one more thing: Every TCP/IP-Stack acts/works little bit different as it should be. What do you think, how nmap or p0f do TCP OS Fingerprinting!? Differences in the tcp/ip packets. If you still have questions, feel free to ask. Kind regards, Arturas Zalenekas Network Security Engineer and Analyst
Hi, Sorry but I found out, that there is actually no problem with nmap. I've just not read the output of nmap intently. When I use -sT, nmap shows port 25 and port 4100 are open. That's right. And additionally nmap says, that port 80 and 443 are FILTERED! Because I am new in using nmap I did not think much about this. All other ports that are not listed by nmap are in state closed. When I use -sS, nmap shows again port 25 and 4100 are open. BUT NOW (using -sS) all other ports are in state filtered. And that's why I thought, that nmap does not show all open ports because I was wondering why nmap does not list port 80 and 443. I don't understand, why there is a difference between a connect()-scan and a syn-scan relating to the results nmap provides. Why closed ports are stated as closed when performing a connect()-scan and why cloesed ports are stated as filtered when performing a -sS scan? Could it somehow be related to my backend firewall? I have a frontend fierwall watchguard and a backend firewall isa. Nevertheless, in my opinion both -sT and -sS should state all closed ports as filtered. So why are the results are different when using -sS and -sT ? Best regards -Benjamin Wagrocki- -----Ursprüngliche Nachricht----- Von: FocusHacks [mailto:focushacks () gmail com] Gesendet: Montag, 25. September 2006 17:49 An: Arturas Zalenekas Cc: Benjamin Wagrocki; security-basics () securityfocus com Betreff: Re: Re: nmap -sS SYN-SCAN does not find all open Ports? I echo the sentiment about booting the live CD on a standalone machine. VMWare sometimes acts unpredictably with network tools. Also, If you can, get a tcpdump or ethereal capture of your port scan. This will help determine what's going on. Ideally, you should do it on the monitor port of the switch that your scanning machine is using, or use a hub. Running the capture on the scanning machine directly might yield decieving results (i.e. tcpdump may say that a packet was sent when it may have never actually hit the wire). On 9/25/06, Arturas Zalenekas <security () zalenekas net> wrote:-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, that with VM-Ware could be a problem. Try to boot from the Live-CD directly and then do the scan. That is what you told. You could give Sentoo a try. Its also a Live-CD based on Gentoo. They've build a lot of security tools into (actualy almost everything that I know and use daily). One more suggestion. Try to scan the FW from the internal network or dial-in with VPN and scan internal interfaces and try to use the nmap option -T in polite or other mode. If you have still any questions, feel free to post. Kind regards, Arturas Zalenekas Network Security Engineer and AnalystHello, thanks for Your answer. So here are some more information: I'am trying to scan the firewall (Watchguard X700) of my company from home for securityreasons. So I know which ports are open, because I'am administering the firewall. I use the BackTrack 3.0 (remote-exploit.org) live linux cd. This is based on slackware. Kernel 2.6.156. with Nmap 4.03. On the Watchguard X700 all intrusion prevention features are disabled. So "Block SYN Flod Attacks" is also disabled. The firewall is not blocking me because I can do normal Connect() scans after a SYN-Scan and with the Connect() scan the open ports 80 and 443 are correctly found. Maybe VM-Ware (Windows) is the reason? I've run BackTrack in a vm (direckt access to nic) under Windows. What I will try this evening is to boot the notebook directly with the BackTrack-CD and connecting directly with my ISP. Then performing a SYN-Scan again. Maybe then I will get better results. I will then post my result here. -------------------------------------------------------------------- ------- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life. http://www.msia.norwich.edu/secfocus -------------------------------------------------------------------- ------------BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFF4w1RNnenGjQKnsRAg9kAJ40iog5G+DhjAhMEVbxJCNdLix4KACeIkCw OEDafJpTLK1oFW9lzB5AOs0= =InXK -----END PGP SIGNATURE----- ---------------------------------------------------------------------- ----- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life. http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------- -------
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFGe3iRNnenGjQKnsRAkvRAJ9AaErOkcrxpbvwhUzZWim1BQ0A7wCfWTyk t9rQBD13UcWV3P1kLOyf6Mk= =ECbP -----END PGP SIGNATURE----- --------------------------------------------------------------------------- This list is sponsored by: Norwich University EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life. http://www.msia.norwich.edu/secfocus ---------------------------------------------------------------------------
Current thread:
- nmap -sS SYN-SCAN does not find all open Ports? bwagrocki (Sep 19)
- Re: nmap -sS SYN-SCAN does not find all open Ports? Arturas Zalenekas (Sep 21)
- <Possible follow-ups>
- Re: Re: nmap -sS SYN-SCAN does not find all open Ports? bwagrocki (Sep 22)
- Re: Re: nmap -sS SYN-SCAN does not find all open Ports? Arturas Zalenekas (Sep 25)
- Re: Re: nmap -sS SYN-SCAN does not find all open Ports? FocusHacks (Sep 26)
- AW: Re: nmap -sS SYN-SCAN does not find all open Ports? Benjamin Wagrocki (Sep 26)
- Re: AW: Re: nmap -sS SYN-SCAN does not find all open Ports? Arturas Zalenekas (Sep 27)
- Re: Re: nmap -sS SYN-SCAN does not find all open Ports? Arturas Zalenekas (Sep 25)