Scan with -Pn it's ok, not include any ICMP packet, but the other scan, why it's trying to check the 120, 443 and 80 port when I'm say explicitly check just the 9000?
First, there is no check of a 120 port (either TCP or UDP) in the output you provided, so I will provide no answer for that. Additionally, I am making assumptions that the capture you show is only capturing traffic in one direction (not both) as what is present only makes sense if there is unseen response traffic (and you indicate Nmap shows TCP/9000 open).
As for the rest of what is going on, you do two scans.
The first scan you do
nmap -p 9000 -Pn myIP results in two packets sent from the NMAP host, a TCP SYN and a TCP RST. Clearly you are capturing only one direction of traffic, but the scan completes showing port 9000 open.
That leaves seven packets from your capture to account from the second scan. In your second scan you do
nmap -p 9000 myIP which only differs by omitting the
-Pn. So what does having that flag change? If you check the documentation at nmap.org, the
-Pn option disables host discovery and runs the port scan against every designated host.
Digging a little deeper in the documentation, you will find this description of the default host discovery process if no other discovery techniques are specified:
If none of these host discovery techniques are chosen, Nmap uses a default which is equivalent to the -PE -PS443 -PA80 -PP arguments for Windows or privileged (root) Unix users. Attentive readers know that this means an ICMP echo request, a TCP SYN packet, a TCP ACK packet, and an ICMP timestamp request are sent to each machine.
Now in those last seven packets in your capture, the first four are an ICMP echo (-PE), a TCP SYN to TCP/443 (-PS443), a TCP ACK to TCP/80 (-PA80) and an ICMP timestamp request (-PP). This matches the default action described for host discovery in the Nmap documentation.
The last three packets are a TCP RST for prior SYN connection to TCP/443 and then since the host discovery process has found that the target is online, the port scan SYN and RST for TCP/9000.
If your tcpdump filter was capturing traffic in both directions, you would see the response traffic as well.
Edit for new question (please ask new questions as new questions in the future)
I want to try and understand better the use of -Pn flag and the Discovery Host -with just one flag the PS443 in more tests. But gives unexpected result.
I would argue that this is the expected result.
The host I can ensure that it is open. And with tcpdump I only retrieve 1 packet address from my IP to IPscan with "IP date myIP> IPScan: Flags [s]". That is, the TCP packet with SYN flag active. Then because it puts me that ping probes can block the scan if there is no ping probes in that scan, right?. PS just active the SYN flag..
So, the first command you run
nmap -T2 -sS -PS443 -p 443 <host> indicates the host is down and doesn't perform the port scan.
Your second command holds the answer
nmap -T2 -sS -Pn -PS443 -p 443 <host>. The only difference here is that you h ave added the
-Pn flag, which disables host discovery entirely and assumes all target hosts are up. When it does run the port scan, it shows "443/tcp filtered" as the response.
So your first command, you explicitly tell Nmap to only do a TCP SYN scan of TCP/443 for host discovery. Since the second command shows us that TCP/443 is not open, the first command tries this discovery method and when it doesn't receive the expected response host discovery marks the host as down.
As I noted in my comment, the
-Pn flag was originally added when the ICMP was the host discovery mechanism. As ICMP was increasingly filtered (while this technically violates the ICMP RFCs, it is generally considered a best practice), other host discovery mechanisms were added. The functionality of
-Pn was adjust to include any form of host discovery rather than just ICMP.
While there are repeated references to ICMP or ping in association with
-Pn, the documentation I referenced earlier has this description for
Another option is to skip the Nmap discovery stage altogether. Normally, Nmap uses this stage to determine active machines for heavier scanning. By default, Nmap only performs heavy probing such as port scans, version detection, or OS detection against hosts that are found to be up. Disabling host discovery with the -Pn option causes Nmap to attempt the requested scanning functions against every target IP address specified.