I have Cisco 2911 router just booted with factory settings and no ACLs or NAT configured. All I did is turned on the interfaces and assigned IPs.
I am trying to scan for open ports with Nmap, but the output shows that all ports are closed.
So I used


that returns

All 1000 scanned ports on are closed

Scanning port 80 alone also shows that it is closed

nmap -p 80
80/tcp closed http

And if I try this

nmap -sT -p 80 -Pn

it returns

Host is up.
80/tcp filtered http

I also have webserver running behind the router and I can access it through browser, so obviously at least port 80 is not closed. But it is supposed to be all open, since by default Cisco router has it all ports open. Do I get some fundamental concept wrong or what can be the problem?

  • You never told us if is the IP address of the router or the webserver. In this case we can`t know if you were scanning the router or the server behind it.
    – nassim
    Jul 15, 2021 at 15:14

4 Answers 4


You are nmapping the cisco router, so you are checking the open cisco ports, not the open webserver ports behind it.

If you nmap the webserver you'll find port 80 open.

  • Router should listen on port 80 in order to send it further to the server, no? Nov 16, 2015 at 15:20
  • @ScienceSamovar: That's the clue. You are scanning the router. It should listen on port 80 just in case of being a webserver himself. When you connect to the webserver behind, the router routes the packets to the webserver. Hope it helps.
    – Ra_
    Nov 16, 2015 at 15:33

By default nmap scans only a subset of all ports, as from your command, notice the 1000:

All 1000 scanned ports on are closed

At this point i would use this parameters (notice the -p-, that means all ports)

nmap -vvv -A -sT -p-
  • But why all TCP and UDP ports are closed, when there is no ACL denying them? Nov 16, 2015 at 15:22
  • If you're scanning the router IP you can find open ports only on that IP, not the servers behind. For that to work you should have some ports forwarded to the router's ip, as for example. if your webserver is at than you can tell the router that connections that come for (router's IP) should be forwarded at port 80 and vice versa.
    – Fredi
    Nov 16, 2015 at 15:24

Suppose your webserver has the address then your scan directed to port 80 of the server without a firewall rule on the router(in the middle) or on the target server will show it as open, use this nmap command

nmap -p80

In your scan one result was different for the port, one was filtered and the other was closed. In one you used the default scan (no -s followed by the type) and that does the default SYN scan and in your other scan you did s -sT (which is a full handshake) scan. You were scanning as a privileged user, and that's why the answer changed.


everyone is missing the point. all cisco devices have a http and https web server built in that responds to the basic IP of the device. Why does NMAP not show those ports and also port 22 as open on a brand new device that has no tailoring of commands done yet?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .