0

I am looking at which ports are open for a smtp host (this host is not mine), and I am seeing different outputs for each of two tools (MX toolbox port scan and nmap). The nmap scan shows that port 465 is open, but the MX toolbox is not showing 465 at all.

My questions: why would there be a discrepancy, which tool should I trust more, and is there a way to determine what is going on with this port that is causing it to only show for one tool?

Nmap:

Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-21 10:57 EST
Warning: (IP) giving up on port because retransmission cap hit (10).
Nmap scan report for DOMAIN(taken out).net (IP)
Host is up (0.074s latency).
Other addresses for DOMAIN(taken out).net (not scanned): (5 IPs)
rDNS record for (IP): DOMAIN.net
Not shown: 932 filtered ports, 65 closed ports
PORT    STATE SERVICE
25/tcp  open  smtp
80/tcp  open  http
465/tcp open  smtps

MX toolbox port scan:

mxtoolbox!

I am troubleshooting this for a customer who is trying to connect their email inbox to our software, so I removed their domain and IPs, but I can provide further information as necessary.

Thank you!

Improve this question
5
  • 1
    Well, i already investigated same issue before, and i can confirm for you that mxtoolbox Scanner ip's is already detected by almost of firewall scripts. which lead to fake port response. in other side you can trust your nmap scan since i believe that your ip not flagged before. put in mind that all based on how the firewall configured behind the ip. for example you can scan one time and it's will say open but if you rerun the scan again it's will report it as closed. also you should give a look about scanning without send ping. it's long story actually to tell.
    – αԋɱҽԃ αмєяιcαη
    Dec 28, 2017 at 15:59
  • 1
    for example, scanning with ping enable while the other side configured the firewall to capture SYN packet received and block the IP. which leads to report port as closed while it's actually open.
    – αԋɱҽԃ αмєяιcαη
    Dec 28, 2017 at 16:02
  • thank you @αԋɱҽԃαмєяιcαη, I appreciate you sharing the results of your investigation, and that is supremely helpful! Do you have more information on how I can scan without send ping?
    – Amanda D
    Dec 28, 2017 at 16:04
  • also you can see in mxtoolbox for port 465 is filtered which require smart way to scan it. it's can be different ways.
    – αԋɱҽԃ αмєяιcαη
    Dec 28, 2017 at 16:04
  • 1
    -Pn option to skip ping in nmap.
    – αԋɱҽԃ αмєяιcαη
    Dec 28, 2017 at 16:07

2 Answers 2

Reset to default
1

Well, let me explain for you what happen basically.

KEEP IN MIND THAT MxToolbox IPs is already flagged by many firewall company which already deny almost of they IPs

Basically while you scan the port with ping enabled while the other side filtering the port when it's receive SYN packet so the host gonna give fake response that the port already closed while it's actually open.

There's other configuration can be done that the port will report one time true response status for 1 time and on the second time will give fake response because it's already add your source ip to DENY section.

So the end of that point that you can trust nmap report since i believe that your ip is not flagged by the firewall before.

don't panic if you rerun the scan and got status of port as closed. i explained for you this before.

-Pn is option to skip ping while scanning the target ip. you could try with it.

also you can go with other method to configure another ip to receive the packet sent response, you need to look nmap manual for the options you need actually.

Improve this answer
3
1

MX toolbox scan only some predefined standard ports. It's not scanning port 465 at all. So, you're not seeing that in MX toolbox output.

nmap is in your system and it's scanning all ports and services binded to them.

If mx toolbox says a port as filtered, then it's probably blocked by firewall. If it's saying closed then no service is listening to it. MX toolbox simply not scanning a non standard port doesn't imply anything.

There are several other websites where you can specify a particular port and scan. Google for 'Online Port Scanner' pick any one suitable and scan that particular port.

Also ensure firewall is not blocking the port blusing sudo iptables -S | grep 465

Improve this answer
2
  • She stated that she scanning a target which is not she own ;) so she couldn’t determinate if the port actually open or closed .. also you can use the same site to scan a specific port
    – αԋɱҽԃ αмєяιcαη
    Dec 28, 2017 at 18:59
  • @αԋɱҽԃ αмєяιcαη Yah.. that's true..
    – Abhik Bose
    Dec 28, 2017 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.