52

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP packets on port 22 and 80 and that's it (no HTTPS on that server).

The result of nmap on the first 2048 ports gives 22 and 80 as open, as I expect. However a few ports appear as "filtered".

My question is: why do port 21, 25 and 1863 appear as "filtered" and the 2043 other ports do not appear as filtered?

I expected to see only 22 and 80 as "open".

If it's normal to see 21,25 and 1863 as "filtered", then why aren't all the other ports appearing as "filtered" too!?

Here's the nmap output:

# nmap -PN 94.xx.yy.zz -p1-2048

Starting Nmap 6.00 ( http://nmap.org ) at 2014-06-12 ...
Nmap scan report for ksXXXXXX.kimsufi.com (94.xx.yy.zz)
Host is up (0.0023s latency).
Not shown: 2043 closed ports
PORT     STATE    SERVICE
21/tcp   filtered ftp
22/tcp   open     ssh
25/tcp   filtered smtp
80/tcp   open     http
1863/tcp filtered msnp

I really don't get why I have 2043 closed ports:

Not shown: 2043 closed ports

and not 2046 closed ports.

Here's an lsof launched on the server:

# lsof -i -n
COMMAND   PID USER   FD   TYPE   DEVICE SIZE NODE NAME
named    3789 bind   20u  IPv4     7802       TCP 127.0.0.1:domain (LISTEN)
named    3789 bind   21u  IPv4     7803       TCP 127.0.0.1:953 (LISTEN)
named    3789 bind  512u  IPv4     7801       UDP 127.0.0.1:domain 
sshd     3804 root    3u  IPv4     7830       TCP *:ssh (LISTEN)
sshd     5408 root    3r  IPv4 96926113       TCP 94.xx.yy.zz:ssh->aa.bb.cc.dd:37516 (ESTABLISHED)
sshd     5411    b    3u  IPv4 96926113       TCP 94.xx.yy.zz:ssh->aa.bb.cc.dd:37516 (ESTABLISHED)
java    16589    t   42u  IPv4 88842753       TCP *:http-alt (LISTEN)
java    16589    t   50u  IPv4 88842759       TCP *:8009 (LISTEN)
java    16589    t   51u  IPv4 88842762       TCP 127.0.0.1:8005 (LISTEN)

(note that Java / Tomcat is listening on port 8009 but that port is DROPped by the firewall)

4
  • Do you get the same results when you scan other hosts?
    – Creek
    Jun 12, 2014 at 0:26
  • @Creek: ah, just tried on slashdot.org and got 80 and 443 open but 25/smtp filtered as well. But then you gave me the idea to try to nmap that same server not from my home machine but from another server I own: I don't get the 3 filtered ports but then I get 53/domain/closed, 443/https/closed and 953/rndc/closed. (both my dedicated servers are hosted at OVH / France). Jun 12, 2014 at 1:30
  • 1
    If you really want to see what nmap is doing you should be scanning using root privs, using the SYN scan (-sS) and --packet-trace. Also take a couple minutes and read the man page, you'd be surprised what gems are in there
    – Creek
    Jun 12, 2014 at 1:49
  • I'd also temporarily open those ports and see if packets get through to them.
    – Mark Hurd
    Jun 12, 2014 at 5:50

3 Answers 3

35

'Filtered port' statement from nmap differs according your scan method.

The standard scan (TCP Scan if unprivileged user, or Half-Open scan -sS if superuser) relies on TCP protocol . (named 3-way hanshake)

  • A client (you) issues a SYN, if the server replies SYN/ACK : it means that the port is open !

  • You issue a SYN, if the server replies RST : it means that the port is close !

  • You issue a SYN, if the server does not reply, or replies with ICMP error : it means that the port is filtered. Likely an IDS / statefull firewall block your request)

To figure what is the real status of the port, you can :

The excellent "Nmap Network Discovery" book, written by its creator Fyodor explains this very well. I quote

filtered : Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This sort of filtering slows scans down dramatically.

open|filtered : Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way.

closed|filtered : This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IP ID Idle scan discussed in Section 5.10, "TCP Idle Scan (-sl)

5
  • So how do I unfilter port 22? Suppose I am using Google Domains... Aug 15, 2016 at 7:27
  • "Unfilter" ? Well you do not intercept the traffic going to 22 on your firewall therefore it will not be filtered... You would then get "open" or "close" as a reply to the nmap probe Aug 15, 2016 at 7:49
  • What are you scanning ? Aug 15, 2016 at 12:38
  • I am using this command: sudo nmap -oG - -T4 -A -p22 -v pi.eazyigz.com |grep ssh Aug 15, 2016 at 13:10
  • 1
    "-T4" is unecessary, already specified in "-A"... regarding the probe, sudo nmap implies that a Syn scan is used (-sS). "-A" is a shorter version of "-T4"+"-sV"+"-O". If service detection (-sV) fails probing the SSH server, then the port is likely closed (no ssh listening) otherwise there MUST be something between your client and server that internept the probe and drop the packets (a host firewall, an IDS, or misconfigured network appliances) Aug 16, 2016 at 2:47
15

why do port 21, 25 and 1863 appear as "filtered" and the 2043 other ports do not appear as filtered?

Because in your ISP, router, your network administrator, anything between them, or yourself are filtering them. These ports have a pretty bad history, the 1863 is the port used by the Microsoft instant messaging protocol (aka MSN and friends) which I believe you may (or may not) have set an specific rule. The SMTP one seems like your ISP is the culprit and FTP have me totally flabbergasted, since I have no idea what could happen to them.

4
  • 1
    thanks for the explanation! So "filtered" basically means there's the equivalent of an iptables's REJECT somewhere (ISP, router, etc.)? And the ISP / router or whatever is REJECTing instead of DROPping because it is cleaner? Regarding port 25: it is filtered for me for, say, slashdot.org too (when I nmap it from my home connection, but not when I nmap it from my dedicated server). Jun 12, 2014 at 1:34
  • 7
    @CedricMartin, you've got it exactly backwards. "Filtered" means the packet is dropped (no reply whatsoever), while "closed" means the packet is rejected (an ICMP "port unreachable" reply is sent).
    – Mark
    Jun 12, 2014 at 4:21
  • 1
    @Mark: then if I got it backwards my original question stands: on my server, using iptables, I'm dropping everything besides port 22 and 80. How comes only 3 ports appear as "filtered"!? Jun 12, 2014 at 11:22
  • @CedricMartin edit your question and add your iptables rules.
    – Braiam
    Jun 12, 2014 at 13:36
0

By default, Nmap scans only the most common 1,000 ports for each protocol(tcp,udp). If your port is outside that then it won't scan it and hence won't report it. However, you can specify ports you want to scan with -p option.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .