AW: Re: nmap -sS SYN-SCAN does not find all open Ports?

["Benjamin Wagrocki" <bwagrocki () ficom de>]

Hi,

Sorry but I found out, that there is actually no problem with nmap. I've just not read the output of nmap intently.


When I use -sT, nmap shows port 25 and port 4100 are open. That's right. And additionally nmap says, that port 80 and 
443 are FILTERED!
Because I am new in using nmap I did not think much about this. All other ports that are not listed by nmap are in 
state closed.

When I use -sS, nmap shows again port 25 and 4100 are open. BUT NOW (using -sS) all other ports are in state filtered. 
And that's why I thought, that nmap does not show all open ports because I was wondering why nmap does not list port 80 
and 443.

I don't understand, why there is a difference between a connect()-scan and a syn-scan relating to the results nmap 
provides. Why closed ports are stated as closed when performing a connect()-scan and why cloesed ports are stated as 
filtered when performing a -sS scan?

Could it somehow be related to my backend firewall? I have a frontend fierwall watchguard and a backend firewall isa. 
Nevertheless, in my opinion both -sT and -sS should state all closed ports as filtered. 

So why are the results are different when using -sS and -sT ?

Best regards
 -Benjamin Wagrocki- 





 

-----Ursprüngliche Nachricht-----
Von: FocusHacks [mailto:focushacks () gmail com] 
Gesendet: Montag, 25. September 2006 17:49
An: Arturas Zalenekas
Cc: Benjamin Wagrocki; security-basics () securityfocus com
Betreff: Re: Re: nmap -sS SYN-SCAN does not find all open Ports?

I echo the sentiment about booting the live CD on a standalone machine.  VMWare sometimes acts unpredictably with 
network tools.

Also, If you can, get a tcpdump or ethereal capture of your port scan.
 This will help determine what's going on.  Ideally, you should do it on the monitor port of the switch that your 
scanning machine is using, or use a hub.  Running the capture on the scanning machine directly might yield decieving 
results (i.e. tcpdump may say that a packet was sent when it may have never actually hit the wire).

On 9/25/06, Arturas Zalenekas <security () zalenekas net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi,
>
> that with VM-Ware could be a problem. Try to boot from the Live-CD 
> directly and then do the scan. That is what you told. You could give 
> Sentoo a try. Its also a Live-CD based on Gentoo. They've build a lot 
> of security tools into (actualy almost everything that I know and use daily).
> One more suggestion. Try to scan the FW from the internal network or 
> dial-in with VPN and scan internal interfaces and try to use the nmap 
> option -T in polite or other mode. If you have still any questions, 
> feel free to post.
>
>
>
> Kind regards,
>
> Arturas Zalenekas
> Network Security Engineer and Analyst
>
>
>
> > Hello,
> >
> > thanks for Your answer.
> >
> > So here are some more information:
> >
> > I'am trying to scan the firewall (Watchguard X700) of my company 
> > from home for securityreasons. So I know which ports are open, 
> > because I'am administering the firewall.
> >
> > I use the BackTrack 3.0 (remote-exploit.org) live linux cd. This is 
> > based on slackware. Kernel 2.6.156. with Nmap 4.03.
> >
> > On the Watchguard X700 all intrusion prevention features are 
> > disabled. So "Block SYN Flod Attacks" is also disabled. The firewall 
> > is not blocking me because I can do normal Connect() scans after a 
> > SYN-Scan and with the
> > Connect() scan the open ports 80 and 443 are correctly found.
> >
> > Maybe VM-Ware (Windows) is the reason? I've run BackTrack in a vm 
> > (direckt access to nic) under Windows. What I will try this evening 
> > is to boot the notebook directly with  the BackTrack-CD and 
> > connecting directly with my ISP. Then performing a SYN-Scan again. 
> > Maybe then I will get better results.
> >
> > I will then post my result here.
> >
> > --------------------------------------------------------------------
> > ------- This list is sponsored by: Norwich University
> >
> > EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA 
> > has designated Norwich University a center of Academic Excellence in 
> > Information Security. Our program offers unparalleled Infosec 
> > management education and the case study affords you unmatched 
> > consulting experience.
> > Using interactive e-Learning technology, you can earn this esteemed 
> > degree, without disrupting your career or home life.
> >
> > http://www.msia.norwich.edu/secfocus
> > --------------------------------------------------------------------
> > -------
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (GNU/Linux)
>
> iD8DBQFFF4w1RNnenGjQKnsRAg9kAJ40iog5G+DhjAhMEVbxJCNdLix4KACeIkCw
> OEDafJpTLK1oFW9lzB5AOs0=
> =InXK
> -----END PGP SIGNATURE-----
>
>
> ----------------------------------------------------------------------
> ----- This list is sponsored by: Norwich University
>
> EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has 
> designated Norwich University a center of Academic Excellence in 
> Information Security. Our program offers unparalleled Infosec 
> management education and the case study affords you unmatched consulting experience.
> Using interactive e-Learning technology, you can earn this esteemed 
> degree, without disrupting your career or home life.
>
> http://www.msia.norwich.edu/secfocus
> ----------------------------------------------------------------------
> -----


-- 

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------