2

I have Cisco 2911 router just booted with factory settings and no ACLs or NAT configured. All I did is turned on the interfaces and assigned IPs.
I am trying to scan for open ports with Nmap, but the output shows that all ports are closed.
So I used

nmap 192.168.2.1

that returns

All 1000 scanned ports on 192.168.2.1 are closed

Scanning port 80 alone also shows that it is closed

nmap -p 80 192.168.2.1
PORT STATE SERVICE
80/tcp closed http

And if I try this

nmap -sT -p 80 -Pn 192.168.2.1

it returns

Host is up.
PORT STATE SERVICE
80/tcp filtered http

I also have webserver running behind the router and I can access it through browser, so obviously at least port 80 is not closed. But it is supposed to be all open, since by default Cisco router has it all ports open. Do I get some fundamental concept wrong or what can be the problem?

Improve this question
1
  • You never told us if 192.168.2.1 is the IP address of the router or the webserver. In this case we can`t know if you were scanning the router or the server behind it.
    – nassim
    Jul 15, 2021 at 15:14

4 Answers 4

Reset to default
3

You are nmapping the cisco router, so you are checking the open cisco ports, not the open webserver ports behind it.

If you nmap the webserver you'll find port 80 open.

Improve this answer
2
  • Router should listen on port 80 in order to send it further to the server, no?
    – ScienceSamovar
    Nov 16, 2015 at 15:20
  • @ScienceSamovar: That's the clue. You are scanning the router. It should listen on port 80 just in case of being a webserver himself. When you connect to the webserver behind, the router routes the packets to the webserver. Hope it helps.
    – Ra_
    Nov 16, 2015 at 15:33
0

By default nmap scans only a subset of all ports, as from your command, notice the 1000:

All 1000 scanned ports on 192.168.2.1 are closed

At this point i would use this parameters (notice the -p-, that means all ports)

nmap -vvv -A -sT -p- 192.168.2.1
Improve this answer
2
  • But why all TCP and UDP ports are closed, when there is no ACL denying them?
    – ScienceSamovar
    Nov 16, 2015 at 15:22
  • If you're scanning the router IP you can find open ports only on that IP, not the servers behind. For that to work you should have some ports forwarded to the router's ip, as for example. if your webserver is at 192.168.2.2 than you can tell the router that connections that come for 192.168.2.1 (router's IP) should be forwarded at 192.168.2.2 port 80 and vice versa.
    – Fredi
    Nov 16, 2015 at 15:24
0

Suppose your webserver has the address 192.168.2.3 then your scan directed to port 80 of the server without a firewall rule on the router(in the middle) or on the target server will show it as open, use this nmap command

nmap -p80 192.168.2.3

In your scan one result was different for the port, one was filtered and the other was closed. In one you used the default scan (no -s followed by the type) and that does the default SYN scan and in your other scan you did s -sT (which is a full handshake) scan. You were scanning as a privileged user, and that's why the answer changed.

Improve this answer
0

everyone is missing the point. all cisco devices have a http and https web server built in that responds to the basic IP of the device. Why does NMAP not show those ports and also port 22 as open on a brand new device that has no tailoring of commands done yet?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.