Nmap scan what does STATE=filtered mean? [duplicate]
When I scanned a host for open ports I came across the following result:
What does filtered mean?
2 Answers 2
Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically.
Long story short — Filtered means you cannot access the port from your scanning location, but this doesn’t mean the port is closed on the system itself. Closed on the other hand would mean, you can reach the port, but it is actually closed.
Nmap state filtered что значит
While Nmap has grown in functionality over the years, it began as an efficient port scanner, and that remains its core function. The simple command nmap <target> scans 1,000 TCP ports on the host <target> . While many port scanners have traditionally lumped all ports into the open or closed states, Nmap is much more granular. It divides ports into six states: open , closed , filtered , unfiltered , open|filtered , or closed|filtered .
These states are not intrinsic properties of the port itself, but describe how Nmap sees them. For example, an Nmap scan from the same network as the target may show port 135/tcp as open, while a scan at the same time with the same options from across the Internet might show that port as filtered .
An application is actively accepting TCP connections, UDP datagrams or SCTP associations on this port. Finding these is often the primary goal of port scanning. Security-minded people know that each open port is an avenue for attack. Attackers and pen-testers want to exploit the open ports, while administrators try to close or protect them with firewalls without thwarting legitimate users. Open ports are also interesting for non-security scans because they show services available for use on the network.
A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next.
Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically.
The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Scanning unfiltered ports with other scan types such as Window scan, SYN scan, or FIN scan, may help resolve whether the port is open.
Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way.
This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IP ID idle scan.
Port scanning responses in Nmap for noobs.
Ever wondered what open, close, filtered, unfiltered, open|filtered, close|filtered means during a port scanning engagement in Nmap?
Don’t worry this blog got you all covered. but first, let’s brush some basics.
Penetration Testing consists of 5 steps, and Nmap plays an important role in the first two steps i.e. Reconnaissance and scanning.
Nmap sends, receives, and analyzes all the network for open ports and underlying technologies, and this behavior is only possible in Active reconnaissance.
Typical uses of Nmap in penetration testing include but are not limited to:
- Identifying open ports on a target host
- Mapping out a target’s network
- Finding vulnerabilities on target machines
Various Responses during Nmap port scans:
Nmap remains a port scanning tool at heart. It accomplishes this task by sending raw packets to system ports and listens for responses.
It uses these responses to determine the following possible states of a port on a target machine.
And believe me, even though you might not be an expert in nmap but have seen all the mentioned stuff below.
open
An application on the target machine is actively accepting TCP connections, UDP datagrams or SCTP associations on this port.
Finding these is often the primary goal of port scanning.
Each open port is an avenue for attack.
Penetration testers want to exploit the open ports, while system administrators try to close or protect them with firewalls without thwarting legitimate users.
closed
A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it.
They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection.
Because closed ports are reachable, it may be worth scanning later in case some open up.
Administrators try blocking such ports with a firewall. Then they would appear in the filtered state, discussed next.
filtered
In this case, Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port.
The filtering could be from a dedicated firewall device, router rules, or host-based firewall software.
unfiltered
The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed.
open | filtered
The open|filtered response means that Nmap was unable to determine whether a port is open or filtered.
closed | filtered
The closed|filtered response means that Nmap is unable to determine whether a port is closed or filtered
The open, closed or filtered port states are the ones you will encounter the most on any given port scan.
Now you know the rocket science behind all the responses Nmap gives during port scanning. It was a part of Nmap Learning Module On The Safer Internet Project.
Nmap — руководство для начинающих
nmap — это аббревиатура от «Network Mapper», на русский язык наиболее корректно можно перевести как «сетевой картограф». Возможно, это не лучший вариант перевода на русский язык, но он довольно точно отображает суть — инструмент для исследования сети и проверки безопасности. Утилита кроссплатформенна, бесплатна, поддерживаются операционных системы Linux, Windows, FreeBSD, OpenBSD, Solaris, Mac OS X.
Рассмотрим использование утилиты в Debian. В стандартной поставке дистрибутива nmap отсутствует, установим его командой
# aptitude install nmap
Nmap умеет сканировать различными методами — например, UDP, TCP connect(), TCP SYN (полуоткрытое), FTP proxy (прорыв через ftp), Reverse-ident, ICMP (ping), FIN, ACK, SYN и NULL-сканирование. Выбор варианта сканирования зависит от указанных ключей, вызов nmap выглядит следующим образом:
nmap <ключи> цель
Для опытов возьмем специальный хост для экспериментов, созданный самими разработчиками nmap — scanme.nmap.org. Выполним от root’а
Ключи сканирования задавать необязательно — в этом случае nmap проверит хост на наличие открытых портов и служб, которые слушают эти порты.
Запустим командой:
Через несколько секунд получим результат:
Interesting ports on scanme.nmap.org (74.207.244.221):
Not shown: 998 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Ничего необычного, ssh на стандартном порту и http на 80. Nmap распознаёт следующие состояния портов: open, filtered, closed, или unfiltered. Open означает, что приложение на целевой машине готово для принятия пакетов на этот порт. Filtered означает, что брандмауэр, фильтр, или что-то другое в сети блокирует порт, так что Nmap не может определить, является ли порт открытым или закрытым. Closed — не связанны в данный момент ни с каким приложением, но могут быть открыты в любой момент. Unfiltered порты отвечают на запросы Nmap, но нельзя определить, являются ли они открытыми или закрытыми.
# nmap -O scanme.nmap.org
Хинт: Если во время сканирования нажать пробел — можно увидеть текущий прогресс сканирования и на сколько процентов он выполнен. Через несколько секунд получаем ответ, в котором пока что интересна строчка Device type:
Device type: general purpose|WAP|webcam|storage-misc
Running (JUST GUESSING) : Linux 2.6.X|2.4.X (93%), AXIS Linux 2.6.X (89%), Linksys Linux 2.4.X (89%)
Aggressive OS guesses: Linux 2.6.17 — 2.6.28 (93%), Linux 2.6.9 — 2.6.27 (93%), Linux 2.6.24 (Fedora 8) (92%), Linux 2.6.18 (Slackware 11.0) (92%), Linux 2.6.19 — 2.6.26 (92%), OpenWrt (Linux 2.4.32) (91%), Linux 2.6.22 (91%), Linux 2.6.22 (Fedora Core 6) (90%), Linux 2.6.13 — 2.6.27 (90%), Linux 2.6.9 — 2.6.18 (90%)
No exact OS matches for host (test conditions non-ideal).
Вообще, точную версию ядра средствами nmap определить невозможно, но примерную дату «свежести» и саму операционную систему определить можно. Можно просканировать сразу несколько хостов, для этого надо их перечислить через пробел:
# nmap -O example.com example2.com
Вернемся к нашему подопытному хосту. Хочется узнать поподробнее, какой используется софт. Попробуем уточнить полученные данные с помощью ключей -sV:
# nmap -sV example.com example2.com
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu7 (protocol 2.0)
80/tcp open http Apache httpd 2.2.14 ((Ubuntu))
Service Info: OS: Linux
Прогресс налицо — мы узнали точные названия используемых служб и даже их версии, а заодно узнали точно, какая операционная система стоит на сервере. С расшифровкой никаких проблем не возникает, все вполне понятно.
Агрессивное сканирование можно провести, указав ключ -A
# nmap -A scanme.nmap.org
Nmap выведет очень много информации, я не стану приводить пример. Сканирование может длится довольно долго, занимая несколько минут.
В локальных сетях или просто имея на руках диапазон ip адресов, удобно проверить их на занятость с помощью ключей -sP:
# nmap -sP 192.168.1.0/24
Сканирование проходит довольно быстро, так как по сути это обычный ping-тест, отвечает ли хост на ping. Следует учесть, что хост может не отвечать на ping из-за настроек фаерволла. Если нужный участок сети нельзя ограничить маской, можно указать диапазон адресов, с какого и по какой надо провести сканирование. Например, есть диапазон адресов с 192.168.1.2 до 192.168.1.5. Тогда выполним:
# nmap -sP 192.168.1.2-5
Ответ будет выглядеть так:
Host 192.168.1.2 is up (0.0023s latency)
Host 192.168.1.3 is up (0.0015s latency)
Host 192.168.1.4 is up (0.0018s latency)
Host 192.168.1.5 is up (0.0026s latency)
В моем случае все ip в данный момент были в сети.
Это далеко не все возможности nmap, но уместить их в рамках одной статьи несколько сложновато.
Если вам ближе GUI — есть замечательная утилита Zenmap — графическая оболочка для nmap, умеющая заодно и строить предполагаемую карту сети.
Хочу предупредить, что сканирование портов на удаленных машинах может нарушать закон.
UDPInflame уточнил, что сканирование портов все-таки не является противозаконным.