Questions tagged [port-scanning]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
106 views

Nmap unable to resolve hostnames

I have tried running several nmap commands and I can't get the results to return host names. My results look like this: Nmap scan report for 10.2.16.253 Host is up (0.0025s latency). All 1000 scanned ...
0 votes
0 answers
35 views

cyberscan.io: Do something against scanning?

I receive a lot of 404 from cyberscan.io: 34.159.13.2 - - [11/Aug/2022:17:32:18 +0200] "GET /cgi/en/index.html HTTP/1.1" 404 522 "-" "cyberscan.io" 34.159.13.2 - - [11/...
  • 3,113
0 votes
0 answers
12 views

Counts externally accessed IP addresses via iptables or something similar

I own a hosting company and I often face the situation where my clients using weak passwords end up being broken and at the same time my VPSs become the source of scans on other hosting companies. I ...
  • 1
-1 votes
1 answer
28 views

Scan internal network from cloud system?

I have an internal network with bunch of devices and there is firewall at entry point from internet. Is it possible to scan that entire internal network from the cloud server where I have tool (for ...
  • 3
0 votes
0 answers
20 views

Excessive port scanning on tcp/19139

Recently, I have noticed an excessive amount of scanning attempts on port tcp/19139 for several servers. It does not appear to be an IANA reserved port and I'm not familiar with any applications using ...
0 votes
0 answers
29 views

Network traffic debugging - noticed a lot of traffic from different ports in my VM

I am on a quest to analyze high egress traffic from my VM. Analyzing iftop logs, I noticed that a lot of traffic is conducted from different ports of my VM such as :42272, :42292, :42294, :55166 etc....
  • 1
0 votes
1 answer
89 views

Why my port 27015 is scanned by several ISP across the world?

I configured my server to block all ports except 22,80 and 443 with UFW. I then created a fail2ban rule to put in jail every IP that scan ports unsuccessfully more than 5 times and report it to ...
0 votes
1 answer
185 views

Scanning a range of ports with Ncat?

I'm aware that Nmap is the obvious choice for this task, however I would still like to know if it's possible to scan a range of ports with Ncat. I see that I'm able to scan one port, but with a range ...
  • 101
0 votes
0 answers
33 views

Filter a host so it appears like closed and unfiltered to scanners

I want to filter traffic coming into my Linux box so ports appears like closed instead of "filtered". Using iptables, except for ports I intended to open (-j ACCEPT), I have done the ...
  • 1,058
0 votes
1 answer
93 views

I cant block ACK packets going through port 80

I want to block nmap's ack ping probes and in order to do that, I fist need to block all incoming ack packets coming on port 80. I used this command but it didnt work: iptables -A INPUT -p tcp --dport ...
1 vote
1 answer
961 views

Scan IP range for SSL/TLS versions and vulnerabilities with legible/greppable output

I'm looking to find computers on the network that are using older versions of tls/ssl. So far I've been using nmap's ssl-enum-ciphers and ssl-poodle scripts but the output isn't helpful as it shows ...
0 votes
1 answer
142 views

Router reboots when doing port-scanning [closed]

I'm facing a problem similar to Router reboots when using Nmap. To sum up, I'm doing port-scanning and once the rate is high enough the router reboots (just like described in the thread above using ...
  • 103
0 votes
0 answers
58 views

How to find zombies in network?

Last days I receive reports from my ISP that someone from my network scan ports and trying to connect to openssh services around internet. I assume that nobody does it on purpose, and that someone ...
  • 1
0 votes
0 answers
34 views

Continuous distributed SMTP auth requests for a non-existent user - any idea what the purpose is?

I have thousands of SMTP auth requests for the same non-existent user, from IP addresses mostly in Argentina. There is rarely more than one hit per IP. The login will never work because it's not a ...
's user avatar
0 votes
1 answer
6k views

iptables rules and port scanners blocking

In order to block port scanners on Linux, i have found some rules on iptables to block attacker IP address. These rules work correctly and it blocks the attacker, and logs the attacker ip address in ...
0 votes
0 answers
1k views

On AWS Lightsail I opened all ports but still seems not reachable

I have an aws lightsail instance that I chose to open all tcp ports for public access. See attached below: However, when I tried to nmap remote aws server using my local machine I could not get ports ...
1 vote
1 answer
2k views

How to prevent nmap from fingerprinting HAProxy

In our periodic security scans, our HAProxy instances are always reported as a version disclosure vulnerability. On further inspection, it appears that there are no version banners in any responses ...
4 votes
2 answers
1k views

Server is listening in Port 110 and I can't find any way to disable or block it

I have a Windows 2012 R2 server used as web server, with ports for web (80, 443, and 8080) open for public sites hosted on it. Doing some security checks on it, I found it's listening on port 110 too: ...
3 votes
1 answer
3k views

CentOS 7 SNMP port always closed

I have a CentOS 7 server in which I opened up ports for SNMP connections. Even though I can see the ports open here: [matias@Centos_7_VM ~]$ sudo firewall-cmd --list-all [sudo] password for matias: ...
-2 votes
1 answer
2k views

Hide running service such as Nginx from a port scan

When I run a Port Scan to my server through NMap (like this)... $ nmap -A -p443 example.com ...then I get an output like... Starting Nmap 7.70 ( https://nmap.org ) at 2018-03-29 00:14 BST Nmap scan ...
-1 votes
1 answer
1k views

how to check sctp port in windows command line?

I want to keep monitor a software using sctp port29169 on my windows machine. However, I tried "netstat -an" and it only shows me the TCP and UDP ports. Is there any way that I can check the sctp port ...
  • 1
1 vote
2 answers
987 views

Iptables protection against port scanners without DoS vulnerability

Archwiki features an article with suggestions for a stateful iptables firewall. They recommend some rules to trick port scanners, but advise that they open up a vulnerability for DoS attacks. In ...
0 votes
1 answer
420 views

Understanding fail2ban mechanisms

Apache 2.4 Fail2ban 0.9.6 Jail.local [with_ip_only] Maxretry = 3 Findtime = 600 Bantime= 60000 Banaction = iptables-allports I have this guy [46.xxx] scanning my server and I’m wondering why ...
2 votes
3 answers
5k views

Port scanning and Windows Firewall

I am trying to understand the results I am getting when scanning ports on a machine that has an active built-in Windows Firewall. My test environment has two Windows 7 machines running in Hyper-V VMs ...
  • 21
1 vote
1 answer
5k views

What is the fastest way to scan all ports of a single maching using tcp scan

After reading this post here, from security.stackexchange, I was wondering what is the best way to scan all ports of a single maching using tcp scan only. "nmap -sT -p 1-65535 localhost" is what I ...
  • 11
0 votes
0 answers
167 views

Track down application/process causing computer broacasting destination 255.255.255.255 port 0

We have installed Untangle and we see many broadcasts from 1 IP (client Windows 7). Almost every minute it is broadcasting to 255.255.255.255 port 0. I would like to know how to trace the source of ...
  • 33
1 vote
0 answers
685 views

Efficient way to prevent UDP port scan

I have a Ubuntu server, there are services public in some ports, include TCP and UDP, and trying to protect it against port scanner (TCP and UDP). The TCP scanner block is done by using "recent" ...
  • 121
0 votes
1 answer
2k views

Looking for a web API which can test if a port is open [closed]

There are of course many ways to check if a port is open on a server (nmap, netcat, yougetsignal.com), however, I am curious if anyone knows of a website that has an API that would be callable from a ...
  • 103
0 votes
1 answer
151 views

Unknown device: detected open ports on server that should not exist?

While running a network scan I found open tcp ports reported for a linux machine (port 22-Openssh debian; ports 5124/5127/7582/8282 - Tunnel is OpenSSL) but we only have one linux box and this was not ...
0 votes
0 answers
2k views

Network timeouts with CentOS 7 server running in the same network (Syn-Flooding)

As described above, I'm having problems with my network during my CentOS 7 running. When I first encountered problems with my network I tried to permanently run ping on the main router in the same ...
  • 51
3 votes
2 answers
77 views

Finding XP boxes on our intranet

We're out on a mission to find and eradicate XP boxes on our intranet. Now we're wondering what the fastest (scan) method might be --XP boxes connected to our active directory have already been ...
0 votes
2 answers
1k views

Which ports does NMAP scan for OS-detection

nmap offers OS-detection functionality based TCP/IP fingerprinting by sending six probing packets and analyzing their responses. In the documentation is says that some of them are send to an open port ...
  • 357
18 votes
1 answer
17k views

Displaying nmap result gradually as results are found

To get nmap results, one has to wait for the end of the scan. How can I force nmap to gradually display the newly found hosts and open ports while it is running?
4 votes
2 answers
1k views

Best way to determine if IPs in a subnet are up or down in Linux

I have a simple method that I am using on four subnets to determine which registered IPs are actually up and active, and which ones can be removed. Initially, I iterate through the list of domain ...
0 votes
1 answer
715 views

Nmap scan yields: FATAL: Unknown datalink type (127)

I get an error message trying to scan ports on any remote host using nmap (windows): Starting Nmap 7.25BETA1 ( https://nmap.org ) at 2016-07-28 12:36 Jerusalem Daylight Time NSE: Loaded 138 scripts ...
  • 121
0 votes
2 answers
716 views

What is this strange nginx running on 8088?

I recently made a nmap scan to my server, and I discovered that there was some strange instance of nginx running on port 8088. 8088/tcp open http nginx 1.0.11 | http-methods: |_ ...
-3 votes
1 answer
629 views

Port scan attacks detected from my server [duplicate]

I have dedicated server for my personal projects on Hetzner and today was the second time I got email from them informing that they detected portscan coming from server (first time was in January). At ...
0 votes
3 answers
49k views

How can I find out if a port on a remote server is open as well as a service is listening on it?

I want to check if a set of ports are opened or closed on some remote servers. I went through various discussions on the subject and most of the people suggested to use nmap, nc and telnet <server-...
1 vote
1 answer
2k views

nmap shows strange open ports

Running nmap on my localhost shows me strange open ports: $ nmap -p- localhost Starting Nmap 6.47 ( http://nmap.org ) at 2015-12-28 12:14 CET Nmap scan report for localhost (127.0.0.1) Host is up (0....
  • 234
2 votes
3 answers
6k views

Port-scanning on Cisco router with Nmap

I have Cisco 2911 router just booted with factory settings and no ACLs or NAT configured. All I did is turned on the interfaces and assigned IPs. I am trying to scan for open ports with Nmap, but the ...
4 votes
1 answer
5k views

NMAP (or other) continuous port scan until it returns open?

Is there a way with nmap or anything else to do a continuous port scan, say on port 22, until the service comes up and the port is coming back as open? Kind of like you may have an infinite ping ...
  • 1,112
3 votes
1 answer
2k views

Windows Filtering Platform dropping SQL Server connections

I've been investigating connection issues between my web server (Web01) and a database server (Database01). My current setup: Web01 - two NICs, one external (firewalled), one internal (not firewalled)...
2 votes
1 answer
195 views

How to test iptables settings by port scanning? [closed]

I want to test my iptables and prove that it only allows traffic for given Protocol / Port - combinations. How I can use as a target for a port scan?
  • 133
1 vote
1 answer
84 views

Port 1434 - Company Website hosting blocking us

We have a small network setup on a Windows Domain. We also have a company website that has the same domain name - but is actually not in any way on the domain - it's hosted elsewhere on a cheapo ...
0 votes
0 answers
126 views

outlook doing remote portscanning

A while ago I switched my mailbox on another domain and configured outlook with an exchange server on that domain. Recently for some strange reason my hosting provider has been complaining that ...
11 votes
4 answers
41k views

Is there a way to see what is actually filtering TCP port communication?

nmap -p 7000-7020 10.1.1.1 Will output all the filtered ports Starting Nmap 6.40 ( http://nmap.org ) at 2015-03-04 12:18 EET Nmap scan report for 10.1.1.1 Host is up (0.00091s latency). PORT ...
0 votes
1 answer
3k views

How do I open specific ports on Linux (an AWS instance of RHEL v. 7)? [duplicate]

I'm using RedHat version 7. My AWS instances are in a security group with ample permissions for inbound connectivity. I can do Yum updates. The servers can ping each other. I can transfer files ...
-1 votes
1 answer
300 views

Check my own servers for vulnerabilities [closed]

We are a small early stage startup with not so much money to spend. We have less than 3 servers that we want to monitor for security issues. Our website is essentially on one server having: Ubuntu ...
-1 votes
1 answer
724 views

How do I know how the hacker gained access to my machine? [duplicate]

I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
1 vote
2 answers
917 views

Linux/Bash: Test if my server is opened to the Internet programmatically/via CLI [closed]

RHEL 6 and Bash. It would be easy if I had a remote server to just run nmap from, or even curl/wget, but I only have access to servers on our side of the firewall. I know I can manually check ...