11

Let's suppose we are doing a TCP connect scan.

a nmap scan on google returns the following output :

PORT STATE SERVICE

80/tcp open http

443/tcp open https

However, if I try to open a socket with netcat or telnet on google.com on the port 12 for example, netcat or telnet hangs indefinitely.

Nmap detects the port 12 (and other ports other than 80 or 443) as closed but initiating a TCP connection to them does not instantly closes.

How can nmap know those ports are not filtered but closed ?

Improve this question
1
  • By default(though there's more to that algorithm) the output you'll get from nmap is only the opened ports, not the closed or filter'ed ones. nmap -p 12 www.google.com should normally show it as filtered.
    – nos
    Oct 4, 2013 at 12:36

2 Answers 2

Reset to default
14

With nmap scan, you usually get 3 states:

  • Open - remote computer responded with a SYN/ACK to your SYN
  • Closed - remote computer rejected your connection attempt with a RST packet
  • Filtered - nothing came back, timeout occured

Opening a netcat to port 80 and waiting will not do anything. Port 80 (usually) means a http server is listening on the other side, and it is waiting for a HTTP command (until its own timeout). After netcatting to port 80, try sedinng a GET / to see if you get a reply (probably a http error).

Improve this answer
0
8

A closed port is a port that doesn't have any software listening on it, so an attempt to make a connection to that port on that system will result in the system sending back a TCP RST packet.

A filtered port, on the other hand is typically a port that is blocked by a firewall in the network path, so an attempt to make a connection to that port on that system will result in nothing coming back at all...not even a TCP RST...so a connection attempt will sit there until TCP times out the attempt to connect.

Improve this answer
3
  • This is true but does not answer my question. Open a netcat on google.com on port 42, you won't get an RST packet, but nmap marks this port as closed.
    – Intrepidd
    Oct 3, 2013 at 16:38
  • My nmap to google.com including port 42 returns it as filtered, not closed.
    – Jeff McAdams
    Oct 3, 2013 at 17:00
  • My bad, I thought all ports not shown were closed, but it depends on the global result.
    – Intrepidd
    Oct 3, 2013 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.