Hi,
Sorry but I found out, that there is actually no problem with nmap. I've just
not read the output of nmap intently.
When I use -sT, nmap shows port 25 and port 4100 are open. That's right. And
additionally nmap says, that port 80 and 443 are FILTERED!
Because I am new in using nmap I did not think much about this. All other ports
that are not listed by nmap are in state closed.
When I use -sS, nmap shows again port 25 and 4100 are open. BUT NOW (using -sS)
all other ports are in state filtered. And that's why I thought, that nmap does
not show all open ports because I was wondering why nmap does not list port 80
and 443.
I don't understand, why there is a difference between a connect()-scan and a
syn-scan relating to the results nmap provides. Why closed ports are stated as
closed when performing a connect()-scan and why cloesed ports are stated as
filtered when performing a -sS scan?
Could it somehow be related to my backend firewall? I have a frontend fierwall
watchguard and a backend firewall isa. Nevertheless, in my opinion both -sT and
-sS should state all closed ports as filtered.
So why are the results are different when using -sS and -sT ?
Best regards
-Benjamin Wagrocki-
-----Ursprüngliche Nachricht-----
Von: FocusHacks [mailto:focushacks@gmail.com]
Gesendet: Montag, 25. September 2006 17:49
An: Arturas Zalenekas
Cc: Benjamin Wagrocki; security-basics@securityfocus.com
Betreff: Re: Re: nmap -sS SYN-SCAN does not find all open Ports?
I echo the sentiment about booting the live CD on a standalone machine. VMWare
sometimes acts unpredictably with network tools.
Also, If you can, get a tcpdump or ethereal capture of your port scan.
This will help determine what's going on. Ideally, you should do it on the
monitor port of the switch that your scanning machine is using, or use a hub.
Running the capture on the scanning machine directly might yield decieving
results (i.e. tcpdump may say that a packet was sent when it may have never
actually hit the wire).
On 9/25/06, Arturas Zalenekas <security@zalenekas.net> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
that with VM-Ware could be a problem. Try to boot from the Live-CD
directly and then do the scan. That is what you told. You could give
Sentoo a try. Its also a Live-CD based on Gentoo. They've build a lot
of security tools into (actualy almost everything that I know and use daily).
One more suggestion. Try to scan the FW from the internal network or
dial-in with VPN and scan internal interfaces and try to use the nmap
option -T in polite or other mode. If you have still any questions,
feel free to post.
Kind regards,
Arturas Zalenekas
Network Security Engineer and Analyst
Hello,
thanks for Your answer.
So here are some more information:
I'am trying to scan the firewall (Watchguard X700) of my company
from home for securityreasons. So I know which ports are open,
because I'am administering the firewall.
I use the BackTrack 3.0 (remote-exploit.org) live linux cd. This is
based on slackware. Kernel 2.6.156. with Nmap 4.03.
On the Watchguard X700 all intrusion prevention features are
disabled. So "Block SYN Flod Attacks" is also disabled. The firewall
is not blocking me because I can do normal Connect() scans after a
SYN-Scan and with the
Connect() scan the open ports 80 and 443 are correctly found.
Maybe VM-Ware (Windows) is the reason? I've run BackTrack in a vm
(direckt access to nic) under Windows. What I will try this evening
is to boot the notebook directly with the BackTrack-CD and
connecting directly with my ISP. Then performing a SYN-Scan again.
Maybe then I will get better results.
I will then post my result here.
--------------------------------------------------------------------
------- This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA
has designated Norwich University a center of Academic Excellence in
Information Security. Our program offers unparalleled Infosec
management education and the case study affords you unmatched
consulting experience.
Using interactive e-Learning technology, you can earn this esteemed
degree, without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
--------------------------------------------------------------------
-------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQFFF4w1RNnenGjQKnsRAg9kAJ40iog5G+DhjAhMEVbxJCNdLix4KACeIkCw
OEDafJpTLK1oFW9lzB5AOs0=
=InXK
-----END PGP SIGNATURE-----
----------------------------------------------------------------------
----- This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has
designated Norwich University a center of Academic Excellence in
Information Security. Our program offers unparalleled Infosec
management education and the case study affords you unmatched consulting
experience.
Using interactive e-Learning technology, you can earn this esteemed
degree, without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
----------------------------------------------------------------------
-----
--
---------------------------------------------------------------------------
This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
