Why do nmap -p <port> and nmap -A scans show different results?

Question

I have a C# application that I've written that listens on port 789. It is running on a Windows XP Professional computer. Running

netstat -an | find "789"

TCP    0.0.0.0:789            0.0.0.0:0              LISTENING

When I run nmap -A -vv ip on a different linux machine (but same subnet) it only reports other ports open on the host (i.e. mysql, vnc, etc), but not the port opened by my application.

However, when I run nmap -p 789 ip I get:

PORT     STATE   SERVICE
789/tcp  open  unknown

Why is there a difference between the two nmap scans? Is there anything I can do to ensure that nmap detects the open port when doing a full scan?

Answer 1

By default, nmap only scans for "common" ports (the 1000 most common ports per protocol I believe). Since 789 is not a common port it isn't found. If you do

nmap -A -vv -p- ip

it should scan ports 1-65535.

Here is the nmap documentation that tells what ports are scanned by default: http://nmap.org/book/man-port-specification.html

Answer 2

The only way you could do that is to modify your nmap's services file, which isn't recommended. The -A option runs advanced options, including service detection, OS detection, tracerouting, etc - it doesn't scan the full range. If you want to scan all 65k ports, use the option -p-. Other than that, you've just got to specify the port with -p 789. Your best option is probably to create an alias that does nmap -p 789, to save yourself time.

If you really need to change the services file (/usr/local/share/nmap/nmap-services by default), find the line that reads unknown 789/tcp 0.000075 and replace it with your program's name, and put the number on the end at 0.9, so it's the top port nmap includes. An alias would be much better though.

Answer 3

I'm not sure. It is detecting it as "open", which is what you want right? So it is listening. Why it's not being found with -A, I'm not sure.

Edit - this is from old documentation that might not apply to your version. Run man nmap and let us know what version you have.

From the docs, I see :

"The default is to scan all ports between 1 and 1024 as well as any ports listed in the services file which comes with nmap."

So, 789 should be scanned, even if you don't have it in your services file (since it's labeled as "unknown", I'm sure it's not.)

Thus, I dunno. Check your man file for your version of nmap, maybe its behavior for which ports to scan using -A is different from the document I found?

This one is unlikely, but might be worth investigatin - The difference may be in your user ID on the Linux machine. Privileged vs unprivileged users of NMap have different default scan types. Users with root can do TCP SYN scans, users without will default to TCP connect() .

Answer 4

The nmap -A is the aggressive command as it will run several scripts in the background and that is the main reason why it will give you more results. It combines version detection -sV with Operating system detection -O (capital letter O and not the number zero) and other discovery scripts. Nmap by default, and if not given the specific port number will scan the first 1000 most common ports(these are specified in the nmap-services file which you can edit). The aggressive command can be fed with the ports that you want to scan so you don`t get the results for other ports besides the one you want to scan, TCP 789

nmap -p 789 -A TARGET_IP_ADDRESS_OR_IP_RANGE

whereas if you want only to check if the port, 789 in your case, is open/closed/filtered

nmap -p 789 TARGET_IP_ADDRESS_OR_IP_RANGE

Since -A executes several scripts and is loud(in network traffic terms) it gets easily flagged by IDSs and will most likely be blocked by firewalls or IPSs and that can be one of the reasons that it does not give the correct port status.