Why are some ports reported by nmap filtered and not the others?

Question

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP packets on port 22 and 80 and that's it (no HTTPS on that server).

The result of nmap on the first 2048 ports gives 22 and 80 as open, as I expect. However a few ports appear as "filtered".

My question is: why do port 21, 25 and 1863 appear as "filtered" and the 2043 other ports do not appear as filtered?

I expected to see only 22 and 80 as "open".

If it's normal to see 21,25 and 1863 as "filtered", then why aren't all the other ports appearing as "filtered" too!?

Here's the nmap output:

# nmap -PN 94.xx.yy.zz -p1-2048

Starting Nmap 6.00 ( http://nmap.org ) at 2014-06-12 ...
Nmap scan report for ksXXXXXX.kimsufi.com (94.xx.yy.zz)
Host is up (0.0023s latency).
Not shown: 2043 closed ports
PORT     STATE    SERVICE
21/tcp   filtered ftp
22/tcp   open     ssh
25/tcp   filtered smtp
80/tcp   open     http
1863/tcp filtered msnp

I really don't get why I have 2043 closed ports:

Not shown: 2043 closed ports

and not 2046 closed ports.

Here's an lsof launched on the server:

# lsof -i -n
COMMAND   PID USER   FD   TYPE   DEVICE SIZE NODE NAME
named    3789 bind   20u  IPv4     7802       TCP 127.0.0.1:domain (LISTEN)
named    3789 bind   21u  IPv4     7803       TCP 127.0.0.1:953 (LISTEN)
named    3789 bind  512u  IPv4     7801       UDP 127.0.0.1:domain 
sshd     3804 root    3u  IPv4     7830       TCP *:ssh (LISTEN)
sshd     5408 root    3r  IPv4 96926113       TCP 94.xx.yy.zz:ssh->aa.bb.cc.dd:37516 (ESTABLISHED)
sshd     5411    b    3u  IPv4 96926113       TCP 94.xx.yy.zz:ssh->aa.bb.cc.dd:37516 (ESTABLISHED)
java    16589    t   42u  IPv4 88842753       TCP *:http-alt (LISTEN)
java    16589    t   50u  IPv4 88842759       TCP *:8009 (LISTEN)
java    16589    t   51u  IPv4 88842762       TCP 127.0.0.1:8005 (LISTEN)

(note that Java / Tomcat is listening on port 8009 but that port is DROPped by the firewall)

Answer 1

'Filtered port' statement from nmap differs according your scan method.

The standard scan (TCP Scan if unprivileged user, or Half-Open scan -sS if superuser) relies on TCP protocol . (named 3-way hanshake)

• A client (you) issues a SYN, if the server replies SYN/ACK : it means that the port is open !

• You issue a SYN, if the server replies RST : it means that the port is close !

• You issue a SYN, if the server does not reply, or replies with ICMP error : it means that the port is filtered. Likely an IDS / statefull firewall block your request)

To figure what is the real status of the port, you can :

• use the -sV, or -A option (version detection, it will help you to determine what is the status of this port.
• use --tcp-flags SYN,FIN to try bypassing the fw.
• use other scan types (http://nmap.org/book/man-port-scanning-techniques.html)

The excellent "Nmap Network Discovery" book, written by its creator Fyodor explains this very well. I quote

filtered : Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This sort of filtering slows scans down dramatically.

open|filtered : Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way.

closed|filtered : This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IP ID Idle scan discussed in Section 5.10, "TCP Idle Scan (-sl)

Answer 2

why do port 21, 25 and 1863 appear as "filtered" and the 2043 other ports do not appear as filtered?

Because in your ISP, router, your network administrator, anything between them, or yourself are filtering them. These ports have a pretty bad history, the 1863 is the port used by the Microsoft instant messaging protocol (aka MSN and friends) which I believe you may (or may not) have set an specific rule. The SMTP one seems like your ISP is the culprit and FTP have me totally flabbergasted, since I have no idea what could happen to them.

Answer 3

By default, Nmap scans only the most common 1,000 ports for each protocol(tcp,udp). If your port is outside that then it won't scan it and hence won't report it. However, you can specify ports you want to scan with -p option.