Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

when I do "nmap localhost", some open ports are listed and others aren't. For Example SSH on 22 is listed, but SSH on 10022 is not. Host's port 10022 in my case is NAT port forwarding to a VBoxHeadless VM SSH, and Host's port 22 is it's own SSH port. AT the same time both ports 25 and 10025 are shown, while h.p. 10025 is a real VBoxHeadless-provided SMTP server, and h.p. 25 just redirs there.

share|improve this question
up vote 3 down vote accepted

Are you specifying which ports to scan? be default nmap only scans the known ports for each protocol. From the documentation:

Nmap offers options for specifying which ports are scanned and whether the scan order is randomized or sequential. By default, Nmap scans the most common 1,000 ports for each protocol.

You must specify -p for a wider range:

-p (Only scan specified ports)
This option specifies which ports you want to scan and overrides the default. Individual port numbers are OK, as are ranges separated by a hyphen (e.g. 1-1023). The beginning and/or end values of a range may be omitted, causing Nmap to use 1 and 65535, respectively. So you can specify -p- to scan ports from 1 through 65535. Scanning port zero is allowed if you specify it explicitly. For IP protocol scanning (-sO), this option specifies the protocol numbers you wish to scan for (0–255).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.