Get introduced to the process of port scanning with this Nmap Tutorial and series of more advanced tips. With a basic understanding of networking (IP addresses and Service Ports) you will learn how to not only run a port scanner but also understand what is happening under the hood.
Nmap is the world’s leading port scanner, and a popular part of ourhosted security tools. Nmap as anonline port scanner is able to scan your perimeter network devices and servers from an external perspective; ie outside your firewall.
Nmap Tips and Resources
Open, Closed, Filtered Explained
Parse XML for SSL certificate details
Cheatsheet and Quick Reference
Nmap NSE script to detect Heartbleed
List all IP’s in subnet with Nmap
Automated Nmap Scanning
Getting started with Nmap
Windows or Linux?
Use the operating system that works for you. Nmap will run on a Windowssystem, however it generally works better and is faster under Linux so that would be my recommended platform. In addition having experience with Linux based systems is a great way to get access to a wide selection of security tools.
The installation steps in this guide are for an Ubuntu Linux based system but could be applied with minor changes to other Linux flavors such as Fedora /Centos, or BSD based system.
If you are not using a Linux based system as your main operating system you will likely find it the most convenient and simple to fire up an installation of Ubuntu Linux in a virtual machine. You can then do the installation, play with Linux and break things without affecting your base system. If you are interested in doing remote scanning such as that provided by hackertarget.com you could get a cheap Ubuntu based VPS from one of hundreds of providers, paying anything from $10 per month to $100 or so. Linode is great for this, providing high quality and good specifications for the price.
To get started this is a simple command for scanning your local network (class C or /24):
nmap -sV -p 1-65535 192.168.1.1/24
This command will scan all of your local IP range (assuming your in the 192.168.1.0-254 range), and will perform service identification (-sV) and will scan all ports (-p 1-65535). Since you are running this as a normal user and not root it will be TCP Connect based scan. If you run the command with sudo at the front it will run as a TCP SYN scan.
Zenmap for those who like to click
Start zenmap either from the command line or through your menu. This is the GUI interface to the Nmap scanner. It is solid and works, I prefer the command line as it allows you to script things, collect the output and have more understanding of what’s going on. One nice feature of the Zenmap scanner is the graphical map of the scanned networks, a bit of eye candy if nothing else.
Understanding Open, Closed and Filtered
Nmap has a variety of scan types, understanding how the default and most common SYN scan works is a good place to start to examine how the scan works and interpreting the results.
The 3 way TCP handshake
First a bit of background, during communication with a TCP service, a single connection is established with the TCP 3 way handshake. This involves a SYN sent to an TCP open port that has a service bound to it, typical examples are HTTP (port 80), SMTP (port 25), POP3 (port 110) or SSH (port 22).The server side will see the SYN and respond with SYN ACK, with the client answering the SYN ACK with an ACK. This completes the set up and the data of the service protocol can now be communicated.
In this example the firewall passes the traffic to the web server (HTTP -> 80) and the web server responds with the acknowledgement.In all these examples a firewall could be a separate hardware device, or it could be a local software firewall on the host computer.
Filtered ports or when the Firewall drops a packet
The job of a firewall is to protect a system from unwanted packets that could harm the system. In this simple example the port scan is conducted against port 81, there is no service running on this port using a firewall to block access to it is best practice.
In the case of a filtered port result from Nmap it indicates that the port has not responded at all the SYN packet has simply been dropped by the firewall. See the following Wireshark packet capture, that shows the initial packet with no response.
Closed ports or when the Firewall fails
In this case the closed ports most commonly indicate that there is no service running on the port but the firewall has allowed the connection to go through to the server. It can also mean there is no firewall at all present.Note that while we are discussing the most common scenarios here it is possible to configure a firewall to reject packets rather than drop. This would mean packets hitting the firewall would be seen as closed (the firewall is responding with RST ACK).Pictured below is a case where a firewall rule allows the packet on port 81 through even though there is no service listening on the port. This is most likely due to the fact that the firewall is poorly configured.
An Open Port (service) is found
Open Ports are usually what you are looking for when kicking off Nmap scans. The open service could be a publicly accessible service that is by its nature supposed to be accessible. It could also be a back-end service that does not need to be publicly accessible and therefore should be blocked by a firewall.
An interesting thing to notice in the wireshark capture is the RST packet sent after accepting the SYN ACK from the web server. The RST is sent by Nmap as the state of the port (open) has been determined by the SYN ACK if we were looking for further information such as the HTTP service version or to get the page, the RST would not be sent. A full connection would be established.