To make one open port undetectable with an external nmap scan, it seems easier to make all other scanned ports appear as being opened than to try to make this port appear as being closed.

How can I configure my system in order so that all scanned ports externally with nmap are found to be open?

For instance, with a scan of 1000 ports, an external scanner would see all 1000 ports as open whatever my real open ports may be.

  • I don't have an answer, but you might look at how port knocking software and honeypots work as a basis. – meuh Nov 20 '16 at 10:46

For this you will actually need a program that listens on these ports, whatever it might do with incoming data (probably either echo it back or discard it).

You could use netcat as a very simple "server" to listen on any ports you specified, however you would need one netcat instance per port, which might be quite costly if you want to cover all 2^16 possible ports:

netcat -lp <port> </dev/null >/dev/null 2>&1

This would start a netcat to listen on the specified <port>, which would discard all incoming traffic - but never terminates the connection by itself. Add the -z flag to the command to instantly terminate any connections. Take a look at netcat --help or info netcat for more options.

A possible alternative would be a simple C program which would iterate over all ports that you want covered, open a listening socket on it and do whatever you want with them once a connection comes in; however as I'm not into socket programming right now, I can't give you a more specific example or source code. If you are interested in this solution, look at the man pages socket, bind, listen, accept etc. in section 2, they already have some examples which you could use.

  • Thanks for the answer. How can I stop the listening on one port everytime a new service requires to open it? e.g kill nc -lp 22 when service ssh start is launched. – user200082 Nov 19 '16 at 18:44
  • @user978675 I'm not sure if that's possible at all in this way, and you will probably have to whitelist ports with known services, i.e. if you have ssh don't start the nc -lp 22 at all. This is also a good way of keeping ports closed that you didn't explicitly whitelist. – Wüstengecko Nov 19 '16 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy