I scanned a subnet (16 hosts) while dumping the network traffic with wireshark. I did it 2 times and I noticed that in the traffic there is the normal SYN-SYN/ACK and SYN-RST from open/closed port, but also there are thousands of SYN-SYN/ACK (and ACK for closing connections) from a specific port (first scan was port 111, second scan was port 22).
Why is nmap opening all this connection to the same port on multiple hosts multiple time?
The lenght of the packet is always the same: 78.
edit: the command I run was:
nmap -vv -P0 -sT -O -T5 -p 1-65535 -iL target.txt -oX target.xml