Let's suppose we are doing a TCP connect scan.
a nmap scan on google returns the following output :
PORT STATE SERVICE
80/tcp open http
443/tcp open https
However, if I try to open a socket with netcat or telnet on google.com on the port 12 for example, netcat or telnet hangs indefinitely.
Nmap detects the port 12 (and other ports other than 80 or 443) as closed but initiating a TCP connection to them does not instantly closes.
How can nmap know those ports are not filtered but closed ?