2

An excerpt from the output of netstat:

tcp4       0      0  192.168.2.48.49620     stackoverflow.co.https ESTABLISHED
tcp4       0      0  192.168.2.48.49554     stackoverflow.co.https ESTABLISHED
tcp4       0      0  192.168.2.48.49520     stackoverflow.co.https ESTABLISHED
tcp4       0      0  192.168.2.48.49517     stackoverflow.co.https ESTABLISHED
tcp4       0      0  192.168.2.48.49424     stackoverflow.co.https ESTABLISHED
tcp4       0      0  192.168.2.48.49227     stackoverflow.co.https ESTABLISHED

However, in the output of sudo nmap -p- 192.168.2.48, none of these ports are listed. What is the problem? Why doesn't nmap show all open ports?

  • 4
    Those ports appear to be outbound connections and thus there would be no process accepting connections on those ports. – Andrew Henle May 17 '16 at 18:36
  • @AndrewHenle Is there a way to scan outbound connections then? – Utku May 17 '16 at 18:36
  • You could possibly monitor the network with something like Wireshark. Given enough time, you should pick up your Established connections as traffic flows. This, of course, would only work on a local network. – garethTheRed May 17 '16 at 18:38
  • Also, your local address is rfc1918 and can't reach stackoverflow or other public without being NATted, usually by whatever device provides your public connectivity. The NAT device necessarily knows all connections (and UDP quasiconnections) it handles, which includes all public ones you make, and depending on the device may show them to you. – dave_thompson_085 May 17 '16 at 23:58
  • @Utku Is there a way to scan outbound connections then? You found them with netstat, right? – Andrew Henle May 18 '16 at 11:39
1

You should use the unhide-tcp tool :

unhide-tcp is a forensic tool that identifies TCP/UDP ports that are listening but are not listed in /bin/netstat through brute forcing of all TCP/UDP ports available.

To install it open the terminal and type the follwing command:

sudo apt-get install unhide

To scan run:

unhide-tcp

Why doesn't nmap show all open ports?

According to nmap.org: >By default, Nmap scans the most common 1,000 ports for each protocol.

The question states that -p- option is used. So it must have another reason.

  • I will look into unhide-tcp. But the reason nmap not showing these ports is not the one you have provided. I have used -p- option in nmap. It is in the question. – Utku May 18 '16 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.