Questions tagged [nmap]
Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network.
257
questions
4
votes
2
answers
1k
views
Best way to determine if IPs in a subnet are up or down in Linux
I have a simple method that I am using on four subnets to determine which registered IPs are actually up and active, and which ones can be removed.
Initially, I iterate through the list of domain ...
- 145
6
votes
5
answers
9k
views
IMAP connection with Dovecot keeps failing (time-out)
* TLDR ; if you have connection problems, not only make sure you have added the required rules to your firewall, but also make sure ($ iptables -L -v) that the rules are in the correct order! *
It's ...
- 113
0
votes
1
answer
789
views
Nmap scan yields: FATAL: Unknown datalink type (127)
I get an error message trying to scan ports on any remote host using nmap (windows):
Starting Nmap 7.25BETA1 ( https://nmap.org ) at 2016-07-28 12:36 Jerusalem Daylight Time
NSE: Loaded 138 scripts ...
- 121
17
votes
3
answers
28k
views
Check if remote host/port is open - Can't use GNU Netcat nor NMap - RHEL 7
At work, the infrastructure team is rolling out new VMs with RHEL7 installed as the base OS. This particular image comes with the nmap-ncat version of Netcat and does not have NMap installed. We are ...
-1
votes
1
answer
331
views
Nmap how to split and filter this(regex)?
I think i need a regex code to filter nmap output.txt
I use a tool called: Word List Updater 2.7
so this is the output: http://pastebin.com/HwgiVHDA
I want to filter,remove duplicates and look like ...
- 1
0
votes
1
answer
887
views
IPTables Policy INPUT DROP but accepts connection
I configured iptables with the following rules:
iptables -I INPUT -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 ...
- 133
0
votes
2
answers
221
views
Port Scanning Large Sets of Targets
1)How would you check to see if a list of ~10000 IPs if they have port 80 open?
2)How would you go about the same scenario but with a port range?
3)How would you check a list of 10000 IPs to see ...
- 433
0
votes
2
answers
1k
views
"Nmap Scripting Engine" HTTP Requests
I looked into my nginx access logs to check who accessed my server and I noticed this line:
<IP> - - [25/Feb/2016:02:49:12 +0100] "GET / HTTP/1.1" 302 160 "-" "Mozilla/5.0 (compatible; Nmap ...
- 113
-1
votes
1
answer
1k
views
How to disable unwanted services in vyos?
I am using VYOS server. I used nmap to scan all the open ports.
PORT STATE SERVICE
22/tcp open ssh
111/tcp filtered rpcbind
1521/tcp filtered oracle
1525/tcp filtered orasrv
14520/...
- 139
0
votes
1
answer
1k
views
nmap silent with specific installation directory
Anyone have try to do the installation? it always install to c:\program files\WinPcap directory regardless of the parameter
winpcap-nmap-4.02.exe /S /D="C:\tools\WinPcap\"
http://seclists.org/nmap-...
- 21
2
votes
1
answer
1k
views
How to setup nmap ping count?
I need an arp-ping tool for windows
Tried arp-ping http://www.elifulkerson.com/projects/arp-ping.php.
Source address specification did not work in this tool.
Then I came across nmap. -PR option suits ...
- 45
2
votes
0
answers
447
views
Logstash nmap codec @timestamp match
I am using Logstash to input NMAP scan data into Elasticsearch.
input{
http{
host => "127.0.0.1"
port => 8000
codec => nmap
}
}...
- 33
1
vote
1
answer
2k
views
nmap shows strange open ports
Running nmap on my localhost shows me strange open ports:
$ nmap -p- localhost
Starting Nmap 6.47 ( http://nmap.org ) at 2015-12-28 12:14 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0....
- 244
0
votes
1
answer
835
views
getting a list of live assets using nmap and script?
I'm playing around with a way to find all network assets from the command line that will return an IP, a hostname, and then have a way to see all interfaces associated with that host.
I was using ...
2
votes
4
answers
7k
views
Port-scanning on Cisco router with Nmap
I have Cisco 2911 router just booted with factory settings and no ACLs or NAT configured. All I did is turned on the interfaces and assigned IPs.
I am trying to scan for open ports with Nmap, but the ...
- 123
0
votes
1
answer
446
views
Azure NAT blocking connections
When I try to connect to a port on the public IP address of a node, 50% of the time Azure doesn't respond and nmap marks it as "filtered".
When I try to connect to the same port from the node using ...
-2
votes
1
answer
443
views
cant scan and ping my ip from outside
when I scan my network using nmap it gives me something like this
#nmap -vv -Pn -sV -sT -p80 -oG - 116.135.*.*
# Ports scanned: TCP(1;80) UDP(0;) SCTP(0;) PROTOCOLS(0;)
Host: 116.135.*.* () Status:...
- 11
0
votes
0
answers
606
views
"Filtered" port when accessing server
I'm having periodic trouble accessing one of my DigitalOcean servers from Azure machines.
I have isolated a test that - I believe - demonstrates the issue and captured a tcpdump from the server for ...
1
vote
2
answers
3k
views
Run ncat in background
from some time I'm trying to resolve very annoying issue:
I need to have simple server which will listen on particular TCP port and throw all information which it recieve to trash. I'm doing it by ...
- 119
0
votes
1
answer
637
views
Why nmap result is different from online port scanner result?
I have a vps A, and I am running smtp on it. If I run nmap from my local desktop to scan for my vps it turns out that port 25 (smtp) is filtered. However, if I run online scanner (fill my vps's IP ...
- 103
0
votes
1
answer
418
views
NMAP not mapping DOWN status
I used this command from another post and the file scan.txt only shows the servers with UP status. The listing should also show down status of IP. Is there a switch for that?
nmap -sn -PE -oG scan....
- 3
4
votes
1
answer
6k
views
NMAP (or other) continuous port scan until it returns open?
Is there a way with nmap or anything else to do a continuous port scan, say on port 22, until the service comes up and the port is coming back as open?
Kind of like you may have an infinite ping ...
- 1,162
3
votes
2
answers
4k
views
Is there a reliable way to detect OS of the network hosts from linux workstation?
How to detect OS of running computers on the network.
We use linux. I want to write wrapper on the python, which will periodically scan network and write results to google spreadsheet. I tried nmap -...
- 697
3
votes
2
answers
5k
views
Port 80 filtered nmap
Suddenly my server's port 80 is shown as filtered (no server changes are made). My sites are sometimes timing out or stays in waiting for a very long time (in browser).
Nmap localhost output is below,
...
- 141
0
votes
0
answers
397
views
NMAP port scanning - inconsistent results
I ran the same nmap commands subsequently, and got two sets of results.
I know that there are three open ports, but on each run, only two are shown.
Can anyone explain these results?
ramses@deimos:~...
- 109
-1
votes
2
answers
264
views
I cant open a port iptables - The command runs, but port keeps closed [closed]
I want to make a simple redirect of my notebook port to a VM port (in my notebook also)..
iptables -I INPUT -p tcp --dport 2424 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 2424 -j DNAT --...
- 127
2
votes
1
answer
4k
views
How to interpret nmap result, host up but no ports open
I have used nmap to map a network, scanning using the following command
nmap -v -sS --no-stylesheet -T3 -sU -sV -O -oX <filename.xml> 192.168.69.0/24
Some of the hosts come back with a ...
- 201
0
votes
1
answer
1k
views
Inconsistent nmap scan results
I'm working on a program that depends on scanning the local network for all connected devices and getting their MAC address.
To do this, I'm running the following command:
nmap -sn 10.0.0.*
This is ...
- 103
2
votes
3
answers
2k
views
Why does nmap send two packets in order to test a single port
I run nmap with root privileges using sudo so I assume it has full access to creat raw sockets. Wireshark shows two packets used to test a single port when I used the command
sudo nmap 192.168.110....
- 107
0
votes
1
answer
15k
views
nmap unable to split netmask from target expression [closed]
I'm trying to scan my website with nmap to see what is visible from outside...but
nmap returns this value...
Starting Nmap 6.47 ( http://nmap.org ) at 2015-05-06 01:06 PDT
Unable to split netmask ...
- 11
2
votes
1
answer
206
views
How to test iptables settings by port scanning? [closed]
I want to test my iptables and prove that it only allows traffic for given Protocol / Port - combinations. How I can use as a target for a port scan?
- 133
5
votes
1
answer
5k
views
Nmap external scan shows port open, ASA says port is not open, but do get an socket
Folks, have a weird one, need your expert help. For one of our heavily used external facing server which came up in an audit, nmap -Pn scan shows the following:
Starting Nmap 5.51 ...
Host ...
- 51
0
votes
1
answer
960
views
Why is port 443 (but not port 80) being exposed to nmap when iptables is configured to drop the traffic?
A Debian box is running web services on ports 80 and 443 and iptables is configured to allow web traffic only from white listed ip addresses.
A second Debian box (that is not white listed) is using ...
- 330
0
votes
0
answers
2k
views
Unknown device showing up in network scan
I need some help finding a device that has been showing up whenever I scan my network using Spiceworks' "Inventory" scan.
I can ping the device, but nslookup returns a non-existent domain, and ...
1
vote
0
answers
375
views
One device shows down when more than 160 ip addresses are scanned with nmap
This is bugging me.
I consistently have a single device that fails to respond to an nmap scan when more than ~160 IP addresses are specified. I seem to get mixed results between 150-160 IP addresses ...
- 11
0
votes
0
answers
148
views
outlook doing remote portscanning
A while ago I switched my mailbox on another domain and configured outlook with an exchange server on that domain.
Recently for some strange reason my hosting provider has been complaining that ...
0
votes
1
answer
3k
views
ACL Rule to Open UDP Ports
I have the current rules in an attempt to open port 5060 and 10000-20000 for my VoIP provider. We are on a Cisco 1921 router. This ACL is applied to the WAN port on the router facing the ISP. Nmap ...
- 74
12
votes
4
answers
45k
views
Is there a way to see what is actually filtering TCP port communication?
nmap -p 7000-7020 10.1.1.1
Will output all the filtered ports
Starting Nmap 6.40 ( http://nmap.org ) at 2015-03-04 12:18 EET
Nmap scan report for 10.1.1.1
Host is up (0.00091s latency).
PORT ...
4
votes
1
answer
2k
views
Completely getting rid of SSLv3 on Apache
Our security team is asking that we completely disable SSLv3 on some of our servers running Apache. I've used the SSLProtocol entry in the ssl.conf file (like SSLProtocol ALL -SSLv2 -SSLv3) and ...
Stefan
0
votes
2
answers
4k
views
Generate List of IP's With User Names On Windows Network
We recently setup GFI WebMonitor on our network which is giving me back IP's instead of User's. I'm in the process of determining whether we will be able to implement authentication on the proxy to ...
- 443
2
votes
2
answers
5k
views
nmap results to find open ports for SIP
I suspect that a firewall, or other security, on either the router, or on tleilax or doge is causing a problem with SIP calls. How do I establish that the connection is allowed and not being blocked?
...
- 229
2
votes
1
answer
9k
views
How to reverse arp using nping for Windows
I would like to send a reverse ARP to resolve an IP address given a MAC address using nping for Windows.
The documentation is not clear on how this should work and I'm unable to find any examples ...
- 181
1
vote
1
answer
3k
views
Port suddenly closed. How to re-open?
I've written a software module in PHP that manages the saving of data in different data stores (MySQL, ElasticSearch and Redis). To test the module, I've created several test plans in Apache JMeter, ...
- 113
5
votes
2
answers
33k
views
Fastest way to scan all hosts that are online
I am looking to find all the hosts that are online in a set of networks.
I would like to find all hosts that are online in the entire network of 170.10.. (there are ~64K possible hosts). The network ...
- 269
2
votes
1
answer
2k
views
Can a port be in the listen state and be closed?
Servers running Debian7.7, Mongodb 1.2.0.6-1.1, Nmap6.0 - Thanks for your time.
I've user who can't connect to mongodb from his Win7 desktop. He has mongodb installed on it and he's trying to connect ...
- 23
0
votes
2
answers
2k
views
nmap port 3128 shows open but no squid running
Im trying to lock down an Ubuntu server and ran nmap -T4 against
my server. Everything looks right except that it shows port 3128
open but I dont run a squid server or anything else I know of on
that ...
- 203
2
votes
1
answer
2k
views
nmap: why is it scanning port 80 with TCP ACK and not SYN?
While reading nmap man pages, I read for the -sn option:
The default host discovery done with -sn consists of an ICMP echo request,
TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp ...
- 2,403
-2
votes
1
answer
53
views
I have a IP address with some open services. How could I contact the owner? [closed]
After having serious problems (DNS incident) I found out an IP address of a machine. Is it in any way possible to contact the owner without knowing anything else like email, domain name or website? I ...
- 11
3
votes
1
answer
1k
views
HTTP Ports are Filtered on New Virtual IPs in LVS (Linux Virtual Server) Load Balancer
I inherited a Linux Virutal Server (LVS) load balancer on CentOS 5.10. Its been running with no issues for quite some time with no worries.
Now when I add a new virutal IP (VIP), all HTTP traffic ...
- 133
0
votes
1
answer
2k
views
nmap repeats the scan to a specific port multiple time
I scanned a subnet (16 hosts) while dumping the network traffic with wireshark.
I did it 2 times and I noticed that in the traffic there is the normal SYN-SYN/ACK and SYN-RST from open/closed port, ...
- 185