Nmap what is filtered

A typical Nmap scan is shown in Example The only Nmap arguments used in this example are -A , to enable OS and version detection, script scanning, and traceroute; -T4 for faster execution; and then the hostname. Chapter Nmap Reference Guide. Example A representative Nmap scan nmap -A -T4 scanme. Create a free Team What is Teams? Learn more. Is there a way to see what is actually filtering TCP port communication? Ask Question. Asked 6 years, 8 months ago. Active 2 years, 6 months ago. Viewed 37k times.

Improve this question. Eduard Florinescu Eduard Florinescu 5 5 gold badges 23 23 silver badges 39 39 bronze badges. Add a comment. Active Oldest Votes. This is what the nmap docs say about the filtered state filtered Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port.

In your case the command might look something like: traceroute Improve this answer. Community Bot 1. There are no active software firewalls on those two machines, nmap -p localhost shows the ports opened, and the dedicate firewall is reportedly opened. The evidence you have suggests that something is filtering we can't know what that is as we don't know your config. Host based firewalls often allow all traffic on the loopback localhost interface so that's a possibly misleading test.

Is there any chance that you use linux with iptables "-j DROP"? What nmap documentation refers as filtered is actually a dropped packet on any protocol. Is this software actually bound to an external IP?

If it's all bound to Check netstat — devicenull. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 destination unreachable: communication administratively prohibited , but filters that simply drop probes without responding are far more common.

This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically. The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed.

Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Nmap places ports in this state when it is unable to determine whether a port is open or filtered.

This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered.