2

I'm trying to understand the difference in NMAP between put -Pn or not. I know that if I'm not mistaken -Pn skip ICMP (ping) scan. Ok.. so I try scan a random VM and intercept the packets with tcpdump. Nmap scan:

1º Scan: nmap -p 9000 -Pn myIP -> Result: open 9000

2º Scan: nmap -p 9000 myIP -> Result: open 9000

Packets intercept: enter image description here

Scan with -Pn it's ok, not include any ICMP packet, but the other scan, why it's trying to check the 120, 443 and 80 port when I'm say explicitly check just the 9000?


Edit:

Ok, regarding about what you say in the first post @YLearn:

I want to try and understand better the use of -Pn flag and the Discovery Host -with just one flag the PS443 in more tests. But gives unexpected result.

Tried to launch the following commands

enter image description here

"nmap -sS -PS443 IPscan" result host down. It says

"Note: Hosts seems down. If it is really up, but blocking our pings probes, trye -Pn"

The host I can ensure that it is open. And with tcpdump I only retrieve 1 packet address from my IP to IPscan with "IP date myIP> IPScan: Flags [s]". That is, the TCP packet with SYN flag active. Then because it puts me that ping probes can block the scan if there is no ping probes in that scan, right?. PS just active the SYN flag..

Ok, so in the other scan try with -Pn. and gets that the Host is up (perfect) and port 443 filtered. Okay. But capturing with tcpdump is capture exactly the same type of package as before. do not understand... :(

4
  • 1
    Actually, there is no 120 port in your output. 80 and 443 are common ports for scan, for some version of nmap are default for scan of host, with ICMP (if you do not -Pn). So nothing wrong in this behavior. Nov 28 '19 at 20:22
  • If someone has provided an answer that resolves your question, please consider marking it as the accepted answer. This will reward both the person who provided the answer and yourself with additional reputation. If you found your answer elsewhere, please post your own answer and accept it. Questions without an accepted answer will periodically get refreshed back to the main page, possibly distracting community members from other questions they may be able to help answer for other users. Thank you.
    – YLearn
    Dec 1 '19 at 23:10
  • Please avoid asking follow up questions within the same question. It is generally better to ask them as a new question (and reference the existing question as necessary).
    – YLearn
    Dec 3 '19 at 21:26
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 16 '20 at 23:49
3

Scan with -Pn it's ok, not include any ICMP packet, but the other scan, why it's trying to check the 120, 443 and 80 port when I'm say explicitly check just the 9000?

First, there is no check of a 120 port (either TCP or UDP) in the output you provided, so I will provide no answer for that. Additionally, I am making assumptions that the capture you show is only capturing traffic in one direction (not both) as what is present only makes sense if there is unseen response traffic (and you indicate Nmap shows TCP/9000 open).

As for the rest of what is going on, you do two scans.

The first scan you do nmap -p 9000 -Pn myIP results in two packets sent from the NMAP host, a TCP SYN and a TCP RST. Clearly you are capturing only one direction of traffic, but the scan completes showing port 9000 open.

That leaves seven packets from your capture to account from the second scan. In your second scan you do nmap -p 9000 myIP which only differs by omitting the -Pn. So what does having that flag change? If you check the documentation at nmap.org, the -Pn option disables host discovery and runs the port scan against every designated host.

Digging a little deeper in the documentation, you will find this description of the default host discovery process if no other discovery techniques are specified:

If none of these host discovery techniques are chosen, Nmap uses a default which is equivalent to the -PE -PS443 -PA80 -PP arguments for Windows or privileged (root) Unix users. Attentive readers know that this means an ICMP echo request, a TCP SYN packet, a TCP ACK packet, and an ICMP timestamp request are sent to each machine.

Now in those last seven packets in your capture, the first four are an ICMP echo (-PE), a TCP SYN to TCP/443 (-PS443), a TCP ACK to TCP/80 (-PA80) and an ICMP timestamp request (-PP). This matches the default action described for host discovery in the Nmap documentation.

The last three packets are a TCP RST for prior SYN connection to TCP/443 and then since the host discovery process has found that the target is online, the port scan SYN and RST for TCP/9000.

If your tcpdump filter was capturing traffic in both directions, you would see the response traffic as well.


Edit for new question (please ask new questions as new questions in the future)

I want to try and understand better the use of -Pn flag and the Discovery Host -with just one flag the PS443 in more tests. But gives unexpected result.

I would argue that this is the expected result.

The host I can ensure that it is open. And with tcpdump I only retrieve 1 packet address from my IP to IPscan with "IP date myIP> IPScan: Flags [s]". That is, the TCP packet with SYN flag active. Then because it puts me that ping probes can block the scan if there is no ping probes in that scan, right?. PS just active the SYN flag..

So, the first command you run nmap -T2 -sS -PS443 -p 443 <host> indicates the host is down and doesn't perform the port scan.

Your second command holds the answer nmap -T2 -sS -Pn -PS443 -p 443 <host>. The only difference here is that you h ave added the -Pn flag, which disables host discovery entirely and assumes all target hosts are up. When it does run the port scan, it shows "443/tcp filtered" as the response.

So your first command, you explicitly tell Nmap to only do a TCP SYN scan of TCP/443 for host discovery. Since the second command shows us that TCP/443 is not open, the first command tries this discovery method and when it doesn't receive the expected response host discovery marks the host as down.

As I noted in my comment, the -Pn flag was originally added when the ICMP was the host discovery mechanism. As ICMP was increasingly filtered (while this technically violates the ICMP RFCs, it is generally considered a best practice), other host discovery mechanisms were added. The functionality of -Pn was adjust to include any form of host discovery rather than just ICMP.

While there are repeated references to ICMP or ping in association with -Pn, the documentation I referenced earlier has this description for -Pn:

Another option is to skip the Nmap discovery stage altogether. Normally, Nmap uses this stage to determine active machines for heavier scanning. By default, Nmap only performs heavy probing such as port scans, version detection, or OS detection against hosts that are found to be up. Disabling host discovery with the -Pn option causes Nmap to attempt the requested scanning functions against every target IP address specified.

2
  • Great explanation @YLearn. My confusion was because I have seen besides the ICMP packets the TCP SYN and (to 443) and TCP ACK (to 80) packages and don't know why if -Pn just stop ping.. but there are more packages. Thank you!
    – felix89
    Dec 1 '19 at 22:40
  • @felix89, I think some of the documentation has never been properly updated from when ICMP host discovery was the primary method. Some of the documentation for Nmap still indicates "-Pn" disables ICMP, but all the more detailed descriptions always indicates it disables host discovery entirely (all methods).
    – YLearn
    Dec 2 '19 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.