Hot answers tagged

47

Nmap is a great port scanner, but sometimes you want something more authoritative. You can ask the kernel what processes have which ports open by using the netstat utility: me@myhost:~$ sudo netstat -tlnp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:...


32

This is a common one: nmap -n -sn 192.0.2.0/24 -oG - | awk '/Up$/{print $2}' Quick rundown of options and commands: -n turns off reverse name resolution, since you just want IP addresses. On a local LAN this is probably the slowest step, too, so you get a good speed boost. -sn means "Don't do a port scan." It's the same as the older, deprecated -sP with ...


26

Determine your exposure Taking your output from the netstat command, what looks like a lot of services is actually a very short list: $ netstat -lntup | awk '{print $6 $7}'|sed 's/LISTEN//'| cut -d"/" -f2|sort|uniq|grep -v Foreign avahi-daemon:r dhclient dropbox nmbd rpcbind rpc.statd smbd sshd Getting a lay of the land Looking at this list there are ...


24

'Filtered port' statement from nmap differs according your scan method. The standard scan (TCP Scan if unprivileged user, or Half-Open scan -sS if superuser) relies on TCP protocol . (named 3-way hanshake) A client (you) issues a SYN, if the server replies SYN/ACK : it means that the port is open ! You issue a SYN, if the server replies RST : it means that ...


24

By default, nmap scans the thousand most common ports. Ports 2083 and 2222 aren't on that list. In order to perform a complete scan, you need to specify "all ports" (nmap -p 1-65535, or the shortcut form nmap -p-). Port 22, on the other hand, is on the list. If nmap isn't reporting it, it's because something's blocking your access, or the SSH server isn'...


17

On Linux, you can use: ss -ltu or netstat -ltu To list the listening TCP and UDP ports. Add the -n option (for either ss or netstat) if you want to disable the translation from port number and IP address to service and host name. Add the -p option to see the processes (if any, some ports may be bound by the kernel like for NFS) which are listening (if ...


14

A Linux system has a so called loopback interface, which is for internal communication. Its hostname is localhost and its IP address is 127.0.0.1. When you run nmap on localhost, you actually run the portscan on the virtual loopback interface. 192.168.1.1 is the IP address of your physical (most likely eth0) interface. So you've run nmap on two different ...


13

You're right that the documentation is worded poorly. -sn means "skip the port scan phase," and was previously available as -sP, with the mnemonic "Ping scan". Nmap scans happen in phases. These are: Name resolution NSE script pre-scan phase Host discovery ("ping" scan, but not necessarily ICMP Echo request) Parallel reverse name resolution Port or ...


13

--send-only </dev/null seems to do the trick.


12

127.0.0.1 is not the "outside world", it is looking around inside the house. Check your firewall configuration (iptables in Linux today), most of them shouldn't be accessible from the ouside. Don't run services you don't need. Uninstall all not required software. Change passwords to be stronger. Check your usage of the system, don't go chasing any ...


12

To "close" the port you can use iptables sudo iptables -A INPUT -p tcp --dport 23 -m state --state NEW,ESTABLISHED -j DROP


12

This is easy enough to measure, at least if you nmap a host your machine is not otherwise communicating with. Just use tcpdump or wireshark to capture the traffic, limited to that IP address. You could also use iptables counters, etc. I did so (using wireshark), the machine I tested on has fewer open TCP ports (5), but the totals were 2009 packets, 118,474 ...


11

You can accomplish this with the following awk command: nmap -sP 192.168.3.0/24 \ | awk '/192.168.3/ && !/192.168.3.1$/{print $NF}' This is telling awk to print the last field of the matched line(s)


10

why do port 21, 25 and 1863 appear as "filtered" and the 2043 other ports do not appear as filtered? Because in your ISP, router, your network administrator, anything between them, or yourself are filtering them. These ports have a pretty bad history, the 1863 is the port used by the Microsoft instant messaging protocol (aka MSN and friends) which I believe ...


10

There is not a way to do that within Nmap, but your comment about not wanting "to rely on the output format of nmap" lets me point out that Nmap has two stable output formats for machine-readable parsing. The older one is Grepable output (-oG), which works well for processing with perl, awk, and grep, but is missing some of the more advanced output (like NSE ...


9

You need ICMP type 3 "destination unreachable" packets to provide healthy IP connections. The easiest way to generate ICMP packets type 3 for testing is by using the nping program. The nping program is part of the nmap package, and as such to have it installed. For it you have to do: sudo apt install nmap After having it installed, to test a remote ...


8

I've seen (broken) smart switches going down due to nmap activity, but that was when nmapping a subnet (so ARP traffic for a lot of different endpoints). That may be the kind of problem he's thinking of. Now Intrusion Detection Systems do try and detect port scanning activity and may be configured to block the IP address of the host doing the scanning. If ...


8

The person has used iptables to investigate your firewall rules, and yum to install nmap. This has been done as root. nmap is a tool for remotely investigating the state of another machine's network capabilities, broadly speaking. It allows a person to find open ports and to scan for characteristics of a remote host, and to possibly determine what ...


8

There's no need to scan the entire subnet if you know that you're not interested in part of it. (Avoiding the computer means you don't need to discard its result.) nmap -oG - -sn 192.168.3.2-254 | awk '$NF=="Up" {print $2}' or if you prefer using the XML output instead of the grep output nmap -oX - -sP 192.168.3.2-254 | xmlstarlet sel -t -m '//address[@...


8

In short, they are two different interfaces (192.168.1.97 vs 127.0.0.1), and may have different firewall rules applied and/or services listening. Being on the same machine means relatively little.


7

You misunderstand regex syntax. [16-32] does not mean "match 16, 17, ... or 32". It means "match one character which is either 1 or 2 or in the range 6-3" (which is not a valid range, hence the error). It's possible to write a regex to match a range of integers, but it's complex and error prone. In your case, it would be much easier to use nmap's --...


7

Short answer Yes it is possible, use tsocks nmap -sT IP Long answer First of all Tor doesn't use privoxy, Tor provides an socks proxy for connecting via the Tor network. This means you won't see any network routes or things like that on your system but you have to configure your applications to use the Tor socks proxy to connect via Tor. Typical Tor ...


7

If you want a service (such as SSH) to be available and able to be used, then Nmap will be able to find it. Generally speaking, port scans are not a threat; your security should not depend on an attacker not knowing what services are running. Using a non-standard port for SSH is mainly useful for log noise reduction, since there is so much automated brute-...


7

No, a service listening to a port on an external interface does not necessarily also listen on that port on localhost. You can test this with something like nc -l external-ip-address port-number Then run nmap against localhost, then against the external IP address.


6

In its standard mode, nmap does two different types of scan: a host scan, to determine which hosts are available for further port scanning, and a port scan, which reveals the status of ports on available machines. -sn does no port scan, but it does a host scan -- this is particularly useful when scanning a range with nmap, where it will print out those hosts ...


6

Albeit TCP and UDP are part of TCP/IP, both belong to the same TCP/IP or OSI layers, and both are a layer above IP, they are different protocols. http://www.cyberciti.biz/faq/key-differences-between-tcp-and-udp-protocols/ Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) are two of the core protocols of the Internet Protocol suite....


6

Simple rate limit is not enough because nmap increases scan delay when it hits rate limit. Here is what you can do best with iptables. First create ipset lists ipset create port_scanners hash:ip family inet hashsize 32768 maxelem 65536 timeout 600 ipset create scanned_ports hash:ip,port family inet hashsize 32768 maxelem 65536 timeout 60 And iptables ...


6

You could try with 'awk' command as follow, nmap -sP 192.168.1.* | awk -F"[)(]" '/^Nmap/{Nmap=$(NF-1); C+=1} /^MAC Address/{print C"."$(NF-1) "("Nmap")" }' output, 1. Apple (192.168.1.21) 2. Liteon Technology (192.168.1.15) explanations: with awk's -F open your are telling 'awk' that your inputs are delimited with ( and/or ), as what we specified ...


6

You can also use sudo lsof -i |grep LISTEN which will show all ports currently LISTENing.


6

If you have services that are only bound to the localhost/127.0.0.1 address, they will only show in a 127.0.0.1 nmap scan, and not in others scans to IP addresses on the same host. Such is the case usually, for security reasons, of binding to 127.0.0.1, MySQL, postgresql and mongo DBs for only localhost use, redis and others. Conversely, you can find ...


Only top voted, non community-wiki answers of a minimum length are eligible