Nmap Port Scanning
Nmap's real power is its ability to efficiently scan ports. Nmap offers a variety of port scan techniques, each with their own specific use and expected results. It is important to apply the proper scan technique to the environment and targets being scanned. Port scanning is effective in the enterprise for a number of activities including security auditing, asset management, and compliance. You may be interested in locating systems with file sharing ports or unauthorized File Transfer Protocol (FTP) servers or printers. Open ports reveal potential security weaknesses, provide application and services inventory, and validate compliance with approved software policies. Closed ports are useful for host discovery and OS detection. Remember that port scan results may not always be accurate. Issues such as firewalls and non-RFC compliant hosts and applications can give misleading results. In addition, packet filtering that drops responses to scans slows down the scan significantly as Nmap performs several retries.
SecurityOwned Notes : Nmap Port State
At first glance, you may think that a port can have two states: open and closed. While this is true from the operating system's point of view, Nmap can detect other occurrences effecting state. Nmap detects the following six port states:
SecurityOwned Nmap Port State
| Port State | Description |
|---|---|
| Open | Open ports have an active application accepting TCP connections or UDP packets |
| Closed | Closed ports are accessible, but they do not have a listening application. |
| Filtered | Responses are blocked by a packet filter, therefore Nmap cannot determine if the port is open. |
| Unfiltered | Unfiltered ports are accessible, but Nmap is unable to determine if they are open or closed. (ACK scan only) |
| Open|filtered | Nmap is unable to determine if the port is open or filtered for scan types where open ports do not respond. (UDP, IP Proto, FIN, Null, Xmas scans) |
| Closed|filtered | Nmap is unable to determine if a port is closed or filtered. (IP ID idle scan only) |

![Validate my RSS feed [Valid RSS]](images/valid-rss.png)