2

I ran nmap -p - against a system that I knew to have at least one listening service. The only output that was returned was for port 113 (ident), which showed "closed".

I ran nmap again, but this time used nmap -p # (where # is the port number of a known-open port). This time, Nmap showed the port was open.

I also did nmap -p #-#, where the first # is the start of a contiguous 10-port range that includes the known-open port and the second # is the end. This returns accurate results (showing the known-open port as open, all others in the range as closed) as well.

What could cause this discrepancy? How can I avoid it in the future?

Currently running Nmap via Zenmap 6.49BETA6 on Windows 7 SP1 x64

Iszi
  • 13,775

1 Answers1

1

There may be a firewall with some kind of rate limiting in front of the ports you're scanning.

nmap -p - scans all 65536 TCP ports, which makes it indubitable to anyone who's paying attention that you're running a port scan.

Zaz
  • 2,506
  • 3
  • 28
  • 39