Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i'm just observing what NMAP is doing for the 3 ports it reports are open.

I understand what a half-scan attack is, but what's happening doesnt make sense.

NMAP is reporting ports 139 are 445 are open..... all fine.

But when i look at the control bits, NMAP never sends RST once it has found out the port is open, It does this for port 135- but not 139 and 445. This is what happens:

(I HAVE OMITTED THE victim's replies)

Sends a 2 (SYN)

Sends a 16 (ACK)

Sends a 24 (ACK + PST)

Sends a 16 (ACK)

Sends a 17 (ACK + FIN)

I dont get why NMAP doesnt 'RST' ports 139 and 445??

share|improve this question

migrated from Jun 10 '10 at 17:38

This question came from our site for professional and enthusiast programmers.

This is more of a question for one of stackoverflow sister sites, not stackoverflow itself as this isn't programming related. – TomMD Jun 9 '10 at 19:47
Oh sorry, could you recommend a site? – Tom Jun 9 '10 at 19:50

There's no need to send a RST. The FIN is sufficient to close down the connection; RST is usually only used when an error occurs. I suspect nmap sends the RST in the other cases because sometimes it can provoke a response in buggy TCP stacks even where where the SYN is filtered; if it's succeeding in opening the connection then it already knows the port is open...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.