Questions tagged [nmap]

a free and open-source port scanner, operating system fingerprinter, and service fingerprinter

Filter by
Sorted by
Tagged with
37
votes
5answers
105k views

How to close ports in Linux?

I have some question in closing port, I think I got some strange things. When I use execute nmap --top-ports 10 192.168.1.1 it shows that 23/TCP port is open. But when I execute nmap --top-ports ...
37
votes
2answers
103k views

Why are some ports reported by nmap filtered and not the others?

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP ...
21
votes
3answers
68k views

How to “close” open ports?

A few days ago I started to care a lot about my data security, I end up nmaping myself with: nmap 127.0.0.1 Surprise, surprise, I have lots of active services listen to localhost: $ nmap 127.0.0.1 ...
18
votes
2answers
33k views

Output only the IP addresses of the online machines with nmap

I know how to use nmap to find the list of hosts that are currently online. What I would like to do is get a list of just their IP addresses, now it displays extra information such as Nmap scan ...
17
votes
3answers
45k views

Can nmap display only hosts with specific ports open?

Can nmap list all hosts on the local network that have both SSH and HTTP open? To do so, I can run something like: nmap 192.168.1.1-254 -p22,80 --open However, this lists hosts that have ANY of the ...
14
votes
2answers
10k views

nmap doesn't appear to list all open ports

My rental Linux server doesn't respond to nmap the way I thought it would. When I run nmap it shows three open ports: 80, 443 and 8080. However, I know ports 2083, 22 and 2222 should all be open, as ...
13
votes
1answer
6k views

What's the gnu-netcat's '-z' equivalent option in nmap-ncat?

I check for a listening port on a service prior to running a script using this : until nc -z $HOST $PORT do echo "waiting for service to be available..." sleep 0.5 done exec "/my/script" It ...
12
votes
3answers
11k views

Nmap -sn: scan or no scan?

The nmap man page has this to say about the -sn parameter: -sn (No port scan) . This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that ...
9
votes
3answers
2k views

How many bytes occupy a simple nmap to a host?

Today the IT manager got angry because I used nmap on the 3 servers I manage to see what ports they had open. I know I could have used netstat inside the host' shell. He told me that "If the network ...
7
votes
4answers
916 views

why `nmap 192.168.1.97` returns less services than `nmap 127.0.0.1`? [duplicate]

According to https://networkengineering.stackexchange.com/a/57909/, a packet sent to 192.168.1.97 "doesn't leave the host but is treated like a packet received from the network, addressed to 192.168.1....
7
votes
1answer
823 views

MTU (IPv4) tests in Linux

I noticed I have several networks with all ICMP messages blocked at the firewall level, except for ICMP echo and reply. I know that there is a need at least ICMP messages type 3 in IPv4 have to be ...
6
votes
3answers
904 views

Difference between `nmap local-IP-address` and `nmap localhost`

The following IP address is for my network interface $ nmap 192.168.0.142 Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-09 11:33 EST Nmap scan report for ocean (192.168.0.142) Host is up (0....
6
votes
2answers
8k views

Nmap scan for SNMP enabled devices

Nmap scanning network for SNMP enabled devices: sudo nmap -sU -p 161 --script default,snmp-sysdescr 26.14.32.120/24 I'm trying figure out how make that nmap return only devices that have specific ...
5
votes
1answer
4k views

How does FING (or any of the IP/MAC Address Mappers) work?

Per this comment, I'm going to take advice and ask this as a separate question. I am trying to learn more about networking and security and want to play with tools to help increase my understanding. ...
5
votes
1answer
9k views

nmap -sn lists all active hosts on my network, but nmap -sL does not

When I execute nmap -sn 192.168.1.1-255, I get: Nmap scan report for router (192.168.1.1) Host is up (0.037s latency). Nmap scan report for 192.168.1.17 # This is my smart TV Host is up (0.054s ...
5
votes
2answers
886 views

How to remotely detect another machine's utorrent version with nmap?

How can I use nmap to find out the utorrent version installed on a PC by scanning it from another PC on the same subnet?
5
votes
1answer
344 views

Why Nmap fragmented scan on Linux is only working from virtual environment?

OLD QUESTION AND TITLE (Look further down for the updated question): Why Nmap fragmented scan is only working on Backtrack? I spent quite a few hours today trying to capture and study some ...
4
votes
4answers
825 views

nmap to awk to sed. is there a better way?

I have a project where I know a single computer and a single printer will be the only things on the network. What I want to do is detect when the printer is connected to the network. I also know that ...
4
votes
3answers
654 views

Understanding suspicious SSH commands

I have a dedicated hosting server that has few websites running. I recently accessed my server thru terminal cmd line and noticed that the last few commands that were executed look suspicious and I'm ...
4
votes
1answer
7k views

Run nmap via Tor

Is it possible to runnmap via Tor? When I googled around, I got the impression that Tor uses Polipo / Privoxy, which are socks5 proxies. So any TCP / UDP aware applications should be able to use them ...
4
votes
3answers
10k views

What's the most effective way to detect nmap scans?

I am interested in detecting any nmap scans directed on a (my) GNU/Linux host. I would like to use snort in combination with barnyard2 and snorby for this, or if possible to perform a signature-based ...
4
votes
1answer
457 views

Doing nmap on a network

I used nmap to scan all the ports in the hosts in a network by using the command: $ nmap 172.31.100.0/24 What I found is that it showed the following in the result: Nmap scan report for 172.31....
4
votes
1answer
2k views

Parse (grepable) nmap output to print a list of IP\t[all open ports] with text utils like awk

I would like to find a way to print for each IP address found to have at least one open port, to print that IP address, followed by a list of open ports separated by commas. The ports and IP address ...
4
votes
2answers
6k views

How can I view all device names on LAN?

I am trying to scan my local network and return a list of all connected devices with there IP, MAC Address & device name. By device name, I mean my iPhone should say 'Jamies-iPhone' as it would ...
3
votes
3answers
11k views

How to protect against port scanners?

Is it possible to prevent nmap from observing my machine entirely? After dropping all incoming connections with iptables port scans return as "filtered". It'd prefer if nmap couldn't see what ports ...
3
votes
3answers
750 views

Extracting results from a command in terminal

Extracting results from a command in a terminal I ran a nmap scan on my local network using this command: nmap -sP 192.168.1.* When I ran that command I get something that looks similar to this: ...
3
votes
2answers
23k views

ICMP : Port unreachable error even if port is open

I am testing my Debian Server with some Nmap port Scanning. My Debian is a Virtual Machine running on a bridged connection. Classic port scanning using TCP SYN request works fine and detects port 80 ...
3
votes
1answer
103 views

Nmap Changed My Network?

I am running a clean install of Fedora 24, and I am not sure if I accidentally did some weird key combo, but I entered: nmap -sT -Pn [IPaddress] and, for some reason, this added a PCI network to my ...
3
votes
2answers
3k views

How to tell stateful vs stateless firewall with nmap ACK scan

I'm having trouble figuring this out. Supposedly, nmap can distinguish stateful firewalls from stateless firewalls by using the -sA or ACK scan, but I'm at a loss as to how one would discern that fact ...
3
votes
3answers
1k views

Questions about nmap

I have several questions about nmap. First, nmap can detect servers via: link-layer network-layer transport-layer What are the differences (not in the layer, but in the way that nmap does it) and ...
3
votes
0answers
122 views

Tips for Troubleshooting Remote IMAP/SMTP Host Connection with OPENSSL and NMAP

I work in tech support for a company that has an email inbox integration. Users can input IMAP and SMTP host names and ports and we will attempt to open a connection with those ports and host names so ...
3
votes
0answers
351 views

Why nmap is slow with Debian stretch/testing with Broadcom BCM5708?

I had freshly installed Debian testing for a HP G5 server with Broadcom BCM5708 network card. Nmap scans are about 10 times slower that running on another HP G5 server with different network card. I ...
3
votes
1answer
262 views

Difference between ssl/https and plain https in nmap output

I'm trying to analyze the behavior of an IP that works as free WiFi access point. nmap with parameter (-sV) reports the following for two different measurements: PORT STATE SERVICE VERSION 443/tcp ...
3
votes
0answers
733 views

Why doesn't ufw enforce firewall rules for traffic coming from Virtualbox VM

I've been running Linux Mint 17 on my laptop for a while and thought I had it locked down to not allow any incoming traffic through "Firewall Configuration" (ufw GUI)—I have also validated this from ...
2
votes
6answers
12k views

A way to find open ports on a host machine

I know that i can use nmap to see which ports are open on specific machine. But what i need is a way to get it from the host side itself. Currently, if i use nmap on one of my machines to check the ...
2
votes
3answers
5k views

Grepping several lines from Nmap output

I apologize in advance as this is a simple question. So I'm attempting to scan a Class C to identify all mail servers by IP. The vast majority of IPs aren't mail servers. I'm trying to filter out the ...
2
votes
2answers
2k views

How to skip (omit) a specific port in nmap

With nmap, I want to skip the scan on port 80. I'm sure this is in the man somewhere, but I haven't found it so far. My command is simple: nmap 24.0.0.1\24 So this will scan ports in the 24.0.0.x ...
2
votes
1answer
58 views

How can I find out information about a service?

$ nmap -p0-65535 192.168.0.142 Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-10 17:53 EDT Nmap scan report for ocean (192.168.0.142) Host is up (0.000031s latency). Not shown: 65531 closed ports ...
2
votes
3answers
2k views

How to pass multiple lines to a parameter without a for loop?

I have the following command to process nmap output that contains a list of ips that I've been asked to scan: cat ping-sweep.txt | grep "report for" | cut -d " " -f5 This is providing me a list of ...
2
votes
2answers
3k views

nmap isn't showing sshd?

I want to open a ssh terminal but it gives me a connection refused on port 22. My nmap doesn't list a port 22? How can I connect to my server? PORT STATE SERVICE 21/tcp open ftp 25/...
2
votes
3answers
11k views

Fastest way to port scan. NMAP?

I am looking for a quick way to scan for commonly open ports on proxies. I am doing this through php and I have been using nmap and came up with this command: <?php system("nmap -PN -p U:1194,T:21,...
2
votes
2answers
758 views

Difference between -sn and -sL in Nmap?

Here as man page says, "-sn: Ping Scan - disable port scan", and "-sL: List Scan - simply list targets to scan" I Tried this: ➜ ~ sudo nmap -sn scanme.nmap.org Starting Nmap 7.70 ( https://...
2
votes
1answer
3k views

How to scan for heartbleed vulnerability with nmap from Ubuntu 12.04?

[root@notebook ~] lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 12.04.4 LTS Release: 12.04 Codename: precise [root@notebook ~] dpkg -l nmap | grep ^ii ...
2
votes
1answer
621 views

Running a local port scan and found open ports but, don't know what they're used for?

I wrote a very basic python script to port scan my system. I'm running linux-mint lisa: open_ports = [] for port in xrange(65536): conn = socket.socket(socket.AF_INET, socket.SOCK_STREAM) ...
2
votes
1answer
2k views

Nmap unable to resolve flags

When I type in the command nmap –Pn –sT -sV –p0-65535 192.168.1.100, my terminal responds: Starting Nmap 7.60 ( https://nmap.org ) at 2018-01-29 11:24 PST Failed to resolve "–Pn". Failed to resolve "–...
2
votes
1answer
629 views

Find type of router

Is there a way to find my type of router from the command line? My IP address is the standard 192.168.1.1 IP address.
2
votes
1answer
1k views

Can you send a TCP packet with RST flag set using IPTABLES as a way to trick NMAP into thinking a port is closed?

I am learning Nmap and a thought occurred to me with regards to a SYN scan... A SYN scan sends an empty TCP packet with the SYN flag set to illicit a response from the target of either RST, ...
2
votes
1answer
49 views

How to scan my computer's UDP ports

I have tried running nmap 192.168.0.97 to port-scan my computer, and I noticed it only lists TCP ports. For both TCP and UDP ports, I would start by asking the OS on my computer. I.e. How do I list ...
2
votes
1answer
4k views

nmap raw packet privileges not working (“operation not permitted”, even as root)

Why am I getting the "operation not permitted" with nmap - even when executed as root? $ sudo nmap 192.168.1.2 Starting Nmap 7.12 ( https://nmap.org ) at 2017-01-13 02:12 CST sendto in ...
2
votes
2answers
714 views

Fedora 24: ports show as open when scanned from server, but closed when nmapped from outside

I have a Fedora 24 server, serving an Angular2 project. Angular2 automatically opens ports 3000 and 3001 once the service is started. However, although running nmap localhost shows the ports are open, ...