Questions tagged [nmap]

a free and open-source port scanner, operating system fingerprinter, and service fingerprinter

Filter by
Sorted by
Tagged with
17
votes
3answers
45k views

Can nmap display only hosts with specific ports open?

Can nmap list all hosts on the local network that have both SSH and HTTP open? To do so, I can run something like: nmap 192.168.1.1-254 -p22,80 --open However, this lists hosts that have ANY of the ...
0
votes
1answer
75 views

Value of nmap option

I've found in some docs of port knocking, that it is used the option --host-timeout I don't understand why is 201 assigned to it? e.g.: nmap -Pn --host-timeout 201 --max-retries 0 -p 7000 192.168.80....
1
vote
1answer
114 views

Disable Raspbian MAC advertisement (nmap)

I recently got a Raspberry Pi B+ and installed Raspbian Lite. I'll make a simple server out of it (SSH only and external LUKS-encrypted HDD, so I can access my files from everywhere). I ran nmap to ...
0
votes
1answer
766 views

Knowing the service that opens the port

I want to close unnecessary ports in debian 8.2. $ nmap localhost | grep open 25/tcp open smtp 631/tcp open ipp Searching the service that corresponds to smtp, $ lsof -i:25 $ sudo systemctl --...
14
votes
2answers
10k views

nmap doesn't appear to list all open ports

My rental Linux server doesn't respond to nmap the way I thought it would. When I run nmap it shows three open ports: 80, 443 and 8080. However, I know ports 2083, 22 and 2222 should all be open, as ...
1
vote
1answer
744 views

iptables LOG only once

I run the following iptables commands to detect and log a port scan: iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m ...
1
vote
1answer
2k views

nmap scan takes 50 minutes

I ran nmap -Pn on all possible addresses for the local network and it took 50 minutes. If I limit the range to 100-200, for example, the same scan takes 3-4 minutes. Why is the "full" nmap scan ...
1
vote
1answer
6k views

mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled

I'm using UBUNTU 14.04 as virtual machine on Windows using VMWARE , after logging I installed nmap but after trying to run nmap -sP 10.42.0.0 I get the following message mass_dns: warning: Unable ...
0
votes
1answer
105 views

Unable to use nmap

Just trying to figure out the ip of a wifi device. I'm using: fpollano@debianfx:~$ nmap -n 191.168.0.0-254 Starting Nmap 6.00 ( http://nmap.org ) at 2015-06-19 21:06 EDT Nmap done: 255 IP addresses (...
9
votes
3answers
2k views

How many bytes occupy a simple nmap to a host?

Today the IT manager got angry because I used nmap on the 3 servers I manage to see what ports they had open. I know I could have used netstat inside the host' shell. He told me that "If the network ...
18
votes
2answers
33k views

Output only the IP addresses of the online machines with nmap

I know how to use nmap to find the list of hosts that are currently online. What I would like to do is get a list of just their IP addresses, now it displays extra information such as Nmap scan ...
5
votes
1answer
9k views

nmap -sn lists all active hosts on my network, but nmap -sL does not

When I execute nmap -sn 192.168.1.1-255, I get: Nmap scan report for router (192.168.1.1) Host is up (0.037s latency). Nmap scan report for 192.168.1.17 # This is my smart TV Host is up (0.054s ...
1
vote
2answers
2k views

Nmap script execution to detect heartbleed is failing

Wanting to setup Nmap on my Ubuntu 14.04 LTS system to detect HeartBleed vulnerability. I followed the instructions here: http://cyberarms.wordpress.com/2014/04/20/detecting-openssl-heartbleed-with-...
4
votes
3answers
10k views

What's the most effective way to detect nmap scans?

I am interested in detecting any nmap scans directed on a (my) GNU/Linux host. I would like to use snort in combination with barnyard2 and snorby for this, or if possible to perform a signature-based ...
0
votes
1answer
967 views

Can masscan use the Nmap Scripting Engine?

There is a great tool: https://github.com/robertdavidgraham/masscan that we can use if a bigger network need to be scanned for various aspects. But, can the masscan use the Nmap Scripting Engine? ...
2
votes
1answer
1k views

nmap won't recognize a hostname on my local area network

Scanning the machine on the LAN with my laptop, I got this: gabriele @ osiris { ~ } [ Tue Oct 07 ] [ 08:49 PM] nmap -sP 192.168.1.236 Starting Nmap 6.40 ( http://nmap.org ) at 2014-10-07 20:50 CEST ...
0
votes
1answer
253 views

nmap ipv6 os scan fails

When scanning a ubuntu machine with nmap using ipv6 address, nmap cannot determine the os type and only print the os fingerprint. Although when scanning the same host with ipv4 address it correctly ...
3
votes
1answer
262 views

Difference between ssl/https and plain https in nmap output

I'm trying to analyze the behavior of an IP that works as free WiFi access point. nmap with parameter (-sV) reports the following for two different measurements: PORT STATE SERVICE VERSION 443/tcp ...
3
votes
0answers
734 views

Why doesn't ufw enforce firewall rules for traffic coming from Virtualbox VM

I've been running Linux Mint 17 on my laptop for a while and thought I had it locked down to not allow any incoming traffic through "Firewall Configuration" (ufw GUI)—I have also validated this from ...
1
vote
1answer
509 views

masscan. how to configure Linux?

I've set this in my sysctl.conf: net.netfilter.nf_conntrack_max=268435456 Because, this border 16,777,216 achieved very quick. Also, I've decrease timeouts: net.ipv4.tcp_fin_timeout = 30 net....
37
votes
5answers
105k views

How to close ports in Linux?

I have some question in closing port, I think I got some strange things. When I use execute nmap --top-ports 10 192.168.1.1 it shows that 23/TCP port is open. But when I execute nmap --top-ports ...
2
votes
1answer
3k views

How to scan for heartbleed vulnerability with nmap from Ubuntu 12.04?

[root@notebook ~] lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 12.04.4 LTS Release: 12.04 Codename: precise [root@notebook ~] dpkg -l nmap | grep ^ii ...
1
vote
0answers
2k views

Postgresql 9.1 - Kali Linux

I started to read this book : http://www.amazon.fr/Metasploit-The-Penetration-Testers-Guide/dp/159327288X And I have some trouble with postgresql 9.1 (in Kali Linux). When I start msfconsole, I ...
37
votes
2answers
103k views

Why are some ports reported by nmap filtered and not the others?

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP ...
1
vote
1answer
801 views

Nmap too slow with a network that can't access to internet

I am using CentOS 6.5 and Nmap 5.51 I want to find all alive IPs in a LAN between two IPs Easily get the answer sudo nmap -sP 192.168.1.100-200 my problem when my network can access to internet ...
1
vote
4answers
2k views

Use awk to find all Ports for each IP that have https open

I'd like to print all ips (IP space Port) which have open https ports given a gnmap file. An example output for a line that has only https running on port 443: 123.123.123.123 443 A more elaborate ...
1
vote
2answers
476 views

What does the following script do? [closed]

This was a question on my study guide, and I believe that the script is pinging the ip addresses, so the 2nd choice. Can somebody confirm this for me? The 5th column of NMAP output below is the IP ...
1
vote
0answers
1k views

How to see interactive output when running nmap from a bash script?

I'm trying to run nmap from a Bash script, in a way so that when Enter is pressed it should give some output, as happens when running directly from the commandline. When calling a few different nmap ...
12
votes
3answers
11k views

Nmap -sn: scan or no scan?

The nmap man page has this to say about the -sn parameter: -sn (No port scan) . This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that ...
21
votes
3answers
68k views

How to “close” open ports?

A few days ago I started to care a lot about my data security, I end up nmaping myself with: nmap 127.0.0.1 Surprise, surprise, I have lots of active services listen to localhost: $ nmap 127.0.0.1 ...
5
votes
1answer
344 views

Why Nmap fragmented scan on Linux is only working from virtual environment?

OLD QUESTION AND TITLE (Look further down for the updated question): Why Nmap fragmented scan is only working on Backtrack? I spent quite a few hours today trying to capture and study some ...
2
votes
1answer
621 views

Running a local port scan and found open ports but, don't know what they're used for?

I wrote a very basic python script to port scan my system. I'm running linux-mint lisa: open_ports = [] for port in xrange(65536): conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM) ...
4
votes
1answer
7k views

Run nmap via Tor

Is it possible to runnmap via Tor? When I googled around, I got the impression that Tor uses Polipo / Privoxy, which are socks5 proxies. So any TCP / UDP aware applications should be able to use them ...
1
vote
0answers
2k views

Using nmap's sql-injection script to scan a specific web folder

I'm fairly new to linux and nmap. I'm using debian squeeze. I tried installing an SQL-injection script for nmap. I was able to successfully run a test scan agains my web server running Windows. ...
2
votes
3answers
5k views

Grepping several lines from Nmap output

I apologize in advance as this is a simple question. So I'm attempting to scan a Class C to identify all mail servers by IP. The vast majority of IPs aren't mail servers. I'm trying to filter out the ...
2
votes
2answers
3k views

nmap isn't showing sshd?

I want to open a ssh terminal but it gives me a connection refused on port 22. My nmap doesn't list a port 22? How can I connect to my server? PORT STATE SERVICE 21/tcp open ftp 25/...
2
votes
2answers
2k views

How to skip (omit) a specific port in nmap

With nmap, I want to skip the scan on port 80. I'm sure this is in the man somewhere, but I haven't found it so far. My command is simple: nmap 24.0.0.1\24 So this will scan ports in the 24.0.0.x ...
2
votes
3answers
11k views

Fastest way to port scan. NMAP?

I am looking for a quick way to scan for commonly open ports on proxies. I am doing this through php and I have been using nmap and came up with this command: <?php system("nmap -PN -p U:1194,T:21,...
0
votes
2answers
5k views

nmap script needed to output text into csv format

ultimately I am looking to insert some info into a database. So I'm trying to output a file from something (probably nmap) that is formatted like this: 10.1.150.1,Up,1/3/2012,host.domain.lan 10.1.150....
3
votes
3answers
1k views

Questions about nmap

I have several questions about nmap. First, nmap can detect servers via: link-layer network-layer transport-layer What are the differences (not in the layer, but in the way that nmap does it) and ...
2
votes
4answers
2k views

NMAP probing VirtualBox Client

Cannot seem to probe virtual guests from the virtual host. These guests can be probed from other devices on the same LAN/Network, but not the host. I can understand why it might be struggling, but I ...
4
votes
1answer
457 views

Doing nmap on a network

I used nmap to scan all the ports in the hosts in a network by using the command: $ nmap 172.31.100.0/24 What I found is that it showed the following in the result: Nmap scan report for 172.31....
5
votes
2answers
886 views

How to remotely detect another machine's utorrent version with nmap?

How can I use nmap to find out the utorrent version installed on a PC by scanning it from another PC on the same subnet?
0
votes
2answers
7k views

How to generate random IP addresses

$ nmap -n -iR 0 -sL > RANDOM-IPS-TMP.txt $ grep -o "[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*" RANDOM-IPS-TMP.txt | egrep -v "10.*|172.[16-32].*|192.168.*|[224-255].*" > RANDOM-IPS.txt egrep: Invalid ...
0
votes
3answers
1k views

How to get info about given webserver FAST?

$ time nmap -q -sV -P0 -p80 google.com | fgrep '80/tcp open' 80/tcp open http Google httpd 2.0 (GFE) real 0m6.563s user 0m0.280s sys 0m0.016s $ Are there any faster methods to get info ...