Questions tagged [port-scanning]
The port-scanning tag has no usage guidance.
82
questions
0
votes
0
answers
15
views
nftables : improve anti port scanning rules
I'm looking for ways to confuse port scanners. I do realize it is not that useful, but it is mostly to slow down attackers, and also to avoid ending up on websites like Shodan (or at least make the ...
- 111
0
votes
2
answers
64
views
Apache virtualhosts conf let wrong servername requests going through proxy
I have moved a server configuration to a new server and at the same time configured it with apache mod_proxy to access a gunicorn/django webserver (inside a docker container on port 8000). Previous ...
- 3
2
votes
1
answer
4k
views
Nmap unable to resolve hostnames
I have tried running several nmap commands and I can't get the results to return host names. My results look like this:
Nmap scan report for 10.2.16.253
Host is up (0.0025s latency).
All 1000 scanned ...
- 23
0
votes
0
answers
213
views
cyberscan.io: Do something against scanning?
I receive a lot of 404 from cyberscan.io:
34.159.13.2 - - [11/Aug/2022:17:32:18 +0200] "GET /cgi/en/index.html HTTP/1.1" 404 522 "-" "cyberscan.io"
34.159.13.2 - - [11/...
- 3,703
-1
votes
1
answer
35
views
Scan internal network from cloud system?
I have an internal network with bunch of devices and there is firewall at entry point from internet.
Is it possible to scan that entire internal network from the cloud server where I have tool (for ...
- 3
0
votes
0
answers
45
views
Network traffic debugging - noticed a lot of traffic from different ports in my VM
I am on a quest to analyze high egress traffic from my VM. Analyzing iftop logs, I noticed that a lot of traffic is conducted from different ports of my VM such as :42272, :42292, :42294, :55166 etc....
- 101
0
votes
1
answer
133
views
Why my port 27015 is scanned by several ISP across the world?
I configured my server to block all ports except 22,80 and 443 with UFW.
I then created a fail2ban rule to put in jail every IP that scan ports unsuccessfully more than 5 times and report it to ...
- 101
1
vote
1
answer
1k
views
Scanning a range of ports with Ncat?
I'm aware that Nmap is the obvious choice for this task, however I would still like to know if it's possible to scan a range of ports with Ncat.
I see that I'm able to scan one port, but with a range ...
- 111
0
votes
0
answers
80
views
Filter a host so it appears like closed and unfiltered to scanners
I want to filter traffic coming into my Linux box so ports appears like closed instead of "filtered".
Using iptables, except for ports I intended to open (-j ACCEPT), I have done the ...
- 1,279
0
votes
1
answer
165
views
I cant block ACK packets going through port 80
I want to block nmap's ack ping probes and in order to do that, I fist need to block all incoming ack packets coming on port 80. I used this command but it didnt work:
iptables -A INPUT -p tcp --dport ...
- 1
1
vote
1
answer
1k
views
Scan IP range for SSL/TLS versions and vulnerabilities with legible/greppable output
I'm looking to find computers on the network that are using older versions of tls/ssl.
So far I've been using nmap's ssl-enum-ciphers and ssl-poodle scripts but the output isn't helpful as it shows ...
- 21
0
votes
1
answer
176
views
Router reboots when doing port-scanning [closed]
I'm facing a problem similar to Router reboots when using Nmap. To sum up, I'm doing port-scanning and once the rate is high enough the router reboots (just like described in the thread above using ...
- 103
0
votes
0
answers
82
views
How to find zombies in network?
Last days I receive reports from my ISP that someone from my network scan ports and trying to connect to openssh services around internet.
I assume that nobody does it on purpose, and that someone ...
- 1
0
votes
0
answers
36
views
Continuous distributed SMTP auth requests for a non-existent user - any idea what the purpose is?
I have thousands of SMTP auth requests for the same non-existent user, from IP addresses mostly in Argentina. There is rarely more than one hit per IP.
The login will never work because it's not a ...
user374366
0
votes
1
answer
7k
views
iptables rules and port scanners blocking
In order to block port scanners on Linux, i have found some rules on iptables to block attacker IP address.
These rules work correctly and it blocks the attacker, and logs the attacker ip address in ...
- 753
0
votes
0
answers
2k
views
On AWS Lightsail I opened all ports but still seems not reachable
I have an aws lightsail instance that I chose to open all tcp ports for public access. See attached below:
However, when I tried to nmap remote aws server using my local machine I could not get ports ...
- 101
1
vote
1
answer
2k
views
How to prevent nmap from fingerprinting HAProxy
In our periodic security scans, our HAProxy instances are always reported as a version disclosure vulnerability. On further inspection, it appears that there are no version banners in any responses ...
- 111
4
votes
2
answers
2k
views
Server is listening in Port 110 and I can't find any way to disable or block it
I have a Windows 2012 R2 server used as web server, with ports for web (80, 443, and 8080) open for public sites hosted on it. Doing some security checks on it, I found it's listening on port 110 too:
...
3
votes
1
answer
4k
views
CentOS 7 SNMP port always closed
I have a CentOS 7 server in which I opened up ports for SNMP connections.
Even though I can see the ports open here:
[matias@Centos_7_VM ~]$ sudo firewall-cmd --list-all
[sudo] password for matias:
...
- 213
0
votes
1
answer
3k
views
Hide running service such as Nginx from a port scan
When I run a Port Scan to my server through NMap (like this)...
$ nmap -A -p443 example.com
...then I get an output like...
Starting Nmap 7.70 ( https://nmap.org ) at 2018-03-29 00:14 BST
Nmap scan ...
- 33
0
votes
1
answer
2k
views
how to check sctp port in windows command line?
I want to keep monitor a software using sctp port29169 on my windows machine. However, I tried "netstat -an" and it only shows me the TCP and UDP ports. Is there any way that I can check the sctp port ...
- 11
1
vote
2
answers
1k
views
Iptables protection against port scanners without DoS vulnerability
Archwiki features an article with suggestions for a stateful iptables firewall. They recommend some rules to trick port scanners, but advise that they open up a vulnerability for DoS attacks. In ...
- 115
0
votes
1
answer
464
views
Understanding fail2ban mechanisms
Apache 2.4
Fail2ban 0.9.6
Jail.local
[with_ip_only]
Maxretry = 3
Findtime = 600
Bantime= 60000
Banaction = iptables-allports
I have this guy [46.xxx] scanning my server and I’m wondering why ...
2
votes
3
answers
6k
views
Port scanning and Windows Firewall
I am trying to understand the results I am getting when scanning ports on a machine that has an active built-in Windows Firewall. My test environment has two Windows 7 machines running in Hyper-V VMs ...
- 21
1
vote
1
answer
8k
views
What is the fastest way to scan all ports of a single maching using tcp scan
After reading this post here, from security.stackexchange, I was wondering what is the best way to scan all ports of a single maching using tcp scan only.
"nmap -sT -p 1-65535 localhost" is what I ...
- 11
0
votes
0
answers
224
views
Track down application/process causing computer broacasting destination 255.255.255.255 port 0
We have installed Untangle and we see many broadcasts from 1 IP (client Windows 7). Almost every minute it is broadcasting to 255.255.255.255 port 0.
I would like to know how to trace the source of ...
- 33
1
vote
0
answers
811
views
Efficient way to prevent UDP port scan
I have a Ubuntu server, there are services public in some ports, include TCP and UDP, and trying to protect it against port scanner (TCP and UDP). The TCP scanner block is done by using "recent" ...
- 121
0
votes
1
answer
3k
views
Looking for a web API which can test if a port is open [closed]
There are of course many ways to check if a port is open on a server (nmap, netcat, yougetsignal.com), however, I am curious if anyone knows of a website that has an API that would be callable from a ...
- 103
0
votes
1
answer
196
views
Unknown device: detected open ports on server that should not exist?
While running a network scan I found open tcp ports reported for a linux machine (port 22-Openssh debian; ports 5124/5127/7582/8282 - Tunnel is OpenSSL) but we only have one linux box and this was not ...
- 111
0
votes
0
answers
2k
views
Network timeouts with CentOS 7 server running in the same network (Syn-Flooding)
As described above, I'm having problems with my network during my CentOS 7 running.
When I first encountered problems with my network I tried to permanently run ping on the main router in the same ...
- 151
3
votes
2
answers
98
views
Finding XP boxes on our intranet
We're out on a mission to find and eradicate XP boxes on our intranet.
Now we're wondering what the fastest (scan) method might be --XP boxes connected to our active directory have already been ...
- 489
0
votes
2
answers
1k
views
Which ports does NMAP scan for OS-detection
nmap offers OS-detection functionality based TCP/IP fingerprinting by sending six probing packets and analyzing their responses. In the documentation is says that some of them are send to an open port ...
- 357
23
votes
1
answer
21k
views
Displaying nmap result gradually as results are found
To get nmap results, one has to wait for the end of the scan.
How can I force nmap to gradually display the newly found hosts and open ports while it is running?
- 563
4
votes
2
answers
1k
views
Best way to determine if IPs in a subnet are up or down in Linux
I have a simple method that I am using on four subnets to determine which registered IPs are actually up and active, and which ones can be removed.
Initially, I iterate through the list of domain ...
- 145
0
votes
1
answer
780
views
Nmap scan yields: FATAL: Unknown datalink type (127)
I get an error message trying to scan ports on any remote host using nmap (windows):
Starting Nmap 7.25BETA1 ( https://nmap.org ) at 2016-07-28 12:36 Jerusalem Daylight Time
NSE: Loaded 138 scripts ...
- 121
0
votes
2
answers
924
views
What is this strange nginx running on 8088?
I recently made a nmap scan to my server, and I discovered that there was some strange instance of nginx running on port 8088.
8088/tcp open http nginx 1.0.11
| http-methods:
|_ ...
-3
votes
1
answer
683
views
Port scan attacks detected from my server [duplicate]
I have dedicated server for my personal projects on Hetzner and today was the second time I got email from them informing that they detected portscan coming from server (first time was in January). At ...
- 115
0
votes
3
answers
56k
views
How can I find out if a port on a remote server is open as well as a service is listening on it?
I want to check if a set of ports are opened or closed on some remote servers. I went through various discussions on the subject and most of the people suggested to use nmap, nc and telnet <server-...
- 137
1
vote
1
answer
2k
views
nmap shows strange open ports
Running nmap on my localhost shows me strange open ports:
$ nmap -p- localhost
Starting Nmap 6.47 ( http://nmap.org ) at 2015-12-28 12:14 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0....
- 234
2
votes
4
answers
7k
views
Port-scanning on Cisco router with Nmap
I have Cisco 2911 router just booted with factory settings and no ACLs or NAT configured. All I did is turned on the interfaces and assigned IPs.
I am trying to scan for open ports with Nmap, but the ...
- 123
4
votes
1
answer
6k
views
NMAP (or other) continuous port scan until it returns open?
Is there a way with nmap or anything else to do a continuous port scan, say on port 22, until the service comes up and the port is coming back as open?
Kind of like you may have an infinite ping ...
- 1,152
3
votes
1
answer
2k
views
Windows Filtering Platform dropping SQL Server connections
I've been investigating connection issues between my web server (Web01) and a database server (Database01). My current setup:
Web01 - two NICs, one external (firewalled), one internal (not firewalled)...
- 151
2
votes
1
answer
206
views
How to test iptables settings by port scanning? [closed]
I want to test my iptables and prove that it only allows traffic for given Protocol / Port - combinations. How I can use as a target for a port scan?
- 133
1
vote
1
answer
101
views
Port 1434 - Company Website hosting blocking us
We have a small network setup on a Windows Domain. We also have a company website that has the same domain name - but is actually not in any way on the domain - it's hosted elsewhere on a cheapo ...
- 143
0
votes
0
answers
142
views
outlook doing remote portscanning
A while ago I switched my mailbox on another domain and configured outlook with an exchange server on that domain.
Recently for some strange reason my hosting provider has been complaining that ...
12
votes
4
answers
44k
views
Is there a way to see what is actually filtering TCP port communication?
nmap -p 7000-7020 10.1.1.1
Will output all the filtered ports
Starting Nmap 6.40 ( http://nmap.org ) at 2015-03-04 12:18 EET
Nmap scan report for 10.1.1.1
Host is up (0.00091s latency).
PORT ...
0
votes
1
answer
3k
views
How do I open specific ports on Linux (an AWS instance of RHEL v. 7)? [duplicate]
I'm using RedHat version 7. My AWS instances are in a security group with ample permissions for inbound connectivity. I can do Yum updates. The servers can ping each other. I can transfer files ...
- 158
-1
votes
1
answer
322
views
Check my own servers for vulnerabilities [closed]
We are a small early stage startup with not so much money to spend.
We have less than 3 servers that we want to monitor for security issues.
Our website is essentially on one server having:
Ubuntu
...
-1
votes
1
answer
781
views
How do I know how the hacker gained access to my machine? [duplicate]
I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
- 109
1
vote
2
answers
941
views
Linux/Bash: Test if my server is opened to the Internet programmatically/via CLI [closed]
RHEL 6 and Bash. It would be easy if I had a remote server to just run nmap from, or even curl/wget, but I only have access to servers on our side of the firewall.
I know I can manually check ...
- 616