Anyone seen this before on 4.20/winxp?

["Dude VanWinkle" <dudevanwinkle () gmail com>]

OK, 2 nmap scans below. The same host was scanned, the only difference
between the two is the -T5 flag was used on the second scan, and no -T
flag on the first.

Is this a known IDS that will send responses (verified with a packet
capture) to an insane scan, but not a normal one?

-JP

----------------------------------

nmap -sS -P0 -p 1-200 xxx

Starting Nmap 4.20 ( http://insecure.org ) at 2007-03-26 11:52 Eastern Daylight
Time
All 200 scanned ports on xxx are filtered

Nmap finished: 1 IP address (1 host up) scanned in 47.360 seconds

nmap -sS -P0 -T5 -p 1-200 xxx

Starting Nmap 4.20 ( http://insecure.org ) at 2007-03-26 11:54 Eastern Daylight
Time
Interesting ports on xxx:
PORT    STATE SERVICE
1/tcp   open  tcpmux
2/tcp   open  compressnet
3/tcp   open  compressnet
4/tcp   open  unknown
5/tcp   open  rje
6/tcp   open  unknown
7/tcp   open  echo
8/tcp   open  unknown
9/tcp   open  discard
10/tcp  open  unknown
11/tcp  open  systat
12/tcp  open  unknown
13/tcp  open  daytime
14/tcp  open  unknown
15/tcp  open  netstat
16/tcp  open  unknown
17/tcp  open  qotd
18/tcp  open  msp
19/tcp  open  chargen
20/tcp  open  ftp-data
21/tcp  open  ftp
22/tcp  open  ssh
23/tcp  open  telnet
24/tcp  open  priv-mail
25/tcp  open  smtp
26/tcp  open  unknown
27/tcp  open  nsw-fe
28/tcp  open  unknown
29/tcp  open  msg-icp
30/tcp  open  unknown
31/tcp  open  msg-auth
32/tcp  open  unknown
33/tcp  open  dsp
34/tcp  open  unknown
35/tcp  open  priv-print
36/tcp  open  unknown
37/tcp  open  time
38/tcp  open  rap
39/tcp  open  rlp
40/tcp  open  unknown
41/tcp  open  graphics
42/tcp  open  nameserver
43/tcp  open  whois
44/tcp  open  mpm-flags
45/tcp  open  mpm
46/tcp  open  mpm-snd
47/tcp  open  ni-ftp
48/tcp  open  auditd
49/tcp  open  tacacs
50/tcp  open  re-mail-ck
51/tcp  open  la-maint
52/tcp  open  xns-time
53/tcp  open  domain
54/tcp  open  xns-ch
55/tcp  open  isi-gl
56/tcp  open  xns-auth
57/tcp  open  priv-term
58/tcp  open  xns-mail
59/tcp  open  priv-file
60/tcp  open  unknown
61/tcp  open  ni-mail
62/tcp  open  acas
63/tcp  open  via-ftp
64/tcp  open  covia
65/tcp  open  tacacs-ds
66/tcp  open  sql*net
67/tcp  open  dhcps
68/tcp  open  dhcpc
69/tcp  open  tftp
70/tcp  open  gopher
71/tcp  open  netrjs-1
72/tcp  open  netrjs-2
73/tcp  open  netrjs-3
74/tcp  open  netrjs-4
75/tcp  open  priv-dial
76/tcp  open  deos
77/tcp  open  priv-rje
78/tcp  open  vettcp
79/tcp  open  finger
80/tcp  open  http
81/tcp  open  hosts2-ns
82/tcp  open  xfer
83/tcp  open  mit-ml-dev
84/tcp  open  ctf
85/tcp  open  mit-ml-dev
86/tcp  open  mfcobol
87/tcp  open  priv-term-l
88/tcp  open  kerberos-sec
89/tcp  open  su-mit-tg
90/tcp  open  dnsix
91/tcp  open  mit-dov
92/tcp  open  npp
93/tcp  open  dcp
94/tcp  open  objcall
95/tcp  open  supdup
96/tcp  open  dixie
97/tcp  open  swift-rvf
98/tcp  open  linuxconf
99/tcp  open  metagram
100/tcp open  newacct
101/tcp open  hostname
102/tcp open  iso-tsap
103/tcp open  gppitnp
104/tcp open  acr-nema
105/tcp open  csnet-ns
106/tcp open  pop3pw
107/tcp open  rtelnet
108/tcp open  snagas
109/tcp open  pop2
110/tcp open  pop3
111/tcp open  rpcbind
112/tcp open  mcidas
113/tcp open  auth
114/tcp open  audionews
115/tcp open  sftp
116/tcp open  ansanotify
117/tcp open  uucp-path
118/tcp open  sqlserv
119/tcp open  nntp
120/tcp open  cfdptkt
121/tcp open  erpc
122/tcp open  smakynet
123/tcp open  ntp
124/tcp open  ansatrader
125/tcp open  locus-map
126/tcp open  unitary
127/tcp open  locus-con
128/tcp open  gss-xlicen
129/tcp open  pwdgen
130/tcp open  cisco-fna
131/tcp open  cisco-tna
132/tcp open  cisco-sys
133/tcp open  statsrv
134/tcp open  ingres-net
135/tcp open  msrpc
136/tcp open  profile
137/tcp open  netbios-ns
138/tcp open  netbios-dgm
139/tcp open  netbios-ssn
140/tcp open  emfis-data
141/tcp open  emfis-cntl
142/tcp open  bl-idm
143/tcp open  imap
144/tcp open  news
145/tcp open  uaac
146/tcp open  iso-tp0
147/tcp open  iso-ip
148/tcp open  cronus
149/tcp open  aed-512
150/tcp open  sql-net
151/tcp open  hems
152/tcp open  bftp
153/tcp open  sgmp
154/tcp open  netsc-prod
155/tcp open  netsc-dev
156/tcp open  sqlsrv
157/tcp open  knet-cmp
158/tcp open  pcmail-srv
159/tcp open  nss-routing
160/tcp open  sgmp-traps
161/tcp open  snmp
162/tcp open  snmptrap
163/tcp open  cmip-man
164/tcp open  cmip-agent
165/tcp open  xns-courier
166/tcp open  s-net
167/tcp open  namp
168/tcp open  rsvd
169/tcp open  send
170/tcp open  print-srv
171/tcp open  multiplex
172/tcp open  cl-1
173/tcp open  xyplex-mux
174/tcp open  mailq
175/tcp open  vmnet
176/tcp open  genrad-mux
177/tcp open  xdmcp
178/tcp open  nextstep
179/tcp open  bgp
180/tcp open  ris
181/tcp open  unify
182/tcp open  audit
183/tcp open  ocbinder
184/tcp open  ocserver
185/tcp open  remote-kis
186/tcp open  kis
187/tcp open  aci
188/tcp open  mumps
189/tcp open  qft
190/tcp open  gacp
191/tcp open  prospero
192/tcp open  osu-nms
193/tcp open  srmp
194/tcp open  irc
195/tcp open  dn6-nlm-aud
196/tcp open  dn6-smm-red
197/tcp open  dls
198/tcp open  dls-mon
199/tcp open  smux
200/tcp open  src

Nmap finished: 1 IP address (1 host up) scanned in 21.218 seconds

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org