Questions tagged [port-scanning]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

Same request sent to Squid, but getting 400 Bad Request error when using masscan

I have a hello.txt file with the following contents: GET http://www.google.com/ HTTP/1.1 Host: www.google.com Using netcat it works: cat hello.txt | nc 212.8.251.116 62138 But when I use masscan I ...
0
votes
0answers
36 views

How to find zombies in network?

Last days I receive reports from my ISP that someone from my network scan ports and trying to connect to openssh services around internet. I assume that nobody does it on purpose, and that someone ...
0
votes
0answers
20 views

Continuous distributed SMTP auth requests for a non-existent user - any idea what the purpose is?

I have thousands of SMTP auth requests for the same non-existent user, from IP addresses mostly in Argentina. There is rarely more than one hit per IP. The login will never work because it's not a ...
-1
votes
1answer
1k views

iptables rules and port scanners blocking

In order to block port scanners on Linux, i have found some rules on iptables to block attacker IP address. These rules work correctly and it blocks the attacker, and logs the attacker ip address in ...
0
votes
0answers
337 views

On AWS Lightsail I opened all ports but still seems not reachable

I have an aws lightsail instance that I chose to open all tcp ports for public access. See attached below: However, when I tried to nmap remote aws server using my local machine I could not get ports ...
0
votes
1answer
546 views

How to prevent nmap from fingerprinting HAProxy

In our periodic security scans, our HAProxy instances are always reported as a version disclosure vulnerability. On further inspection, it appears that there are no version banners in any responses ...
4
votes
2answers
543 views

Server is listening in Port 110 and I can't find any way to disable or block it

I have a Windows 2012 R2 server used as web server, with ports for web (80, 443, and 8080) open for public sites hosted on it. Doing some security checks on it, I found it's listening on port 110 too: ...
3
votes
1answer
978 views

CentOS 7 SNMP port always closed

I have a CentOS 7 server in which I opened up ports for SNMP connections. Even though I can see the ports open here: [matias@Centos_7_VM ~]$ sudo firewall-cmd --list-all [sudo] password for matias: ...
-2
votes
1answer
604 views

Hide running service such as Nginx from a port scan

When I run a Port Scan to my server through NMap (like this)... $ nmap -A -p443 example.com ...then I get an output like... Starting Nmap 7.70 ( https://nmap.org ) at 2018-03-29 00:14 BST Nmap scan ...
-1
votes
1answer
623 views

how to check sctp port in windows command line?

I want to keep monitor a software using sctp port29169 on my windows machine. However, I tried "netstat -an" and it only shows me the TCP and UDP ports. Is there any way that I can check the sctp port ...
1
vote
2answers
292 views

Iptables protection against port scanners without DoS vulnerability

Archwiki features an article with suggestions for a stateful iptables firewall. They recommend some rules to trick port scanners, but advise that they open up a vulnerability for DoS attacks. In ...
0
votes
1answer
279 views

Understanding fail2ban mechanisms

Apache 2.4 Fail2ban 0.9.6 Jail.local [with_ip_only] Maxretry = 3 Findtime = 600 Bantime= 60000 Banaction = iptables-allports I have this guy [46.xxx] scanning my server and I’m wondering why ...
2
votes
3answers
3k views

Port scanning and Windows Firewall

I am trying to understand the results I am getting when scanning ports on a machine that has an active built-in Windows Firewall. My test environment has two Windows 7 machines running in Hyper-V VMs ...
1
vote
1answer
2k views

What is the fastest way to scan all ports of a single maching using tcp scan

After reading this post here, from security.stackexchange, I was wondering what is the best way to scan all ports of a single maching using tcp scan only. "nmap -sT -p 1-65535 localhost" is what I ...
0
votes
0answers
91 views

Track down application/process causing computer broacasting destination 255.255.255.255 port 0

We have installed Untangle and we see many broadcasts from 1 IP (client Windows 7). Almost every minute it is broadcasting to 255.255.255.255 port 0. I would like to know how to trace the source of ...
1
vote
0answers
359 views

Efficient way to prevent UDP port scan

I have a Ubuntu server, there are services public in some ports, include TCP and UDP, and trying to protect it against port scanner (TCP and UDP). The TCP scanner block is done by using "recent" ...
0
votes
1answer
865 views

Looking for a web API which can test if a port is open [closed]

There are of course many ways to check if a port is open on a server (nmap, netcat, yougetsignal.com), however, I am curious if anyone knows of a website that has an API that would be callable from a ...
0
votes
1answer
105 views

Unknown device: detected open ports on server that should not exist?

While running a network scan I found open tcp ports reported for a linux machine (port 22-Openssh debian; ports 5124/5127/7582/8282 - Tunnel is OpenSSL) but we only have one linux box and this was not ...
0
votes
0answers
1k views

Network timeouts with CentOS 7 server running in the same network (Syn-Flooding)

As described above, I'm having problems with my network during my CentOS 7 running. When I first encountered problems with my network I tried to permanently run ping on the main router in the same ...
3
votes
2answers
71 views

Finding XP boxes on our intranet

We're out on a mission to find and eradicate XP boxes on our intranet. Now we're wondering what the fastest (scan) method might be --XP boxes connected to our active directory have already been ...
0
votes
2answers
764 views

Which ports does NMAP scan for OS-detection

nmap offers OS-detection functionality based TCP/IP fingerprinting by sending six probing packets and analyzing their responses. In the documentation is says that some of them are send to an open port ...
9
votes
1answer
6k views

Displaying nmap result gradually as results are found

To get nmap results, one has to wait for the end of the scan. How can I force nmap to gradually display the newly found hosts and open ports while it is running?
4
votes
2answers
604 views

Best way to determine if IPs in a subnet are up or down in Linux

I have a simple method that I am using on four subnets to determine which registered IPs are actually up and active, and which ones can be removed. Initially, I iterate through the list of domain ...
0
votes
1answer
385 views

Nmap scan yields: FATAL: Unknown datalink type (127)

I get an error message trying to scan ports on any remote host using nmap (windows): Starting Nmap 7.25BETA1 ( https://nmap.org ) at 2016-07-28 12:36 Jerusalem Daylight Time NSE: Loaded 138 scripts ...
0
votes
2answers
344 views

What is this strange nginx running on 8088?

I recently made a nmap scan to my server, and I discovered that there was some strange instance of nginx running on port 8088. 8088/tcp open http nginx 1.0.11 | http-methods: |_ ...
-3
votes
1answer
361 views

Port scan attacks detected from my server [duplicate]

I have dedicated server for my personal projects on Hetzner and today was the second time I got email from them informing that they detected portscan coming from server (first time was in January). At ...
0
votes
3answers
19k views

How can I find out if a port on a remote server is open as well as a service is listening on it?

I want to check if a set of ports are opened or closed on some remote servers. I went through various discussions on the subject and most of the people suggested to use nmap, nc and telnet <server-...
1
vote
1answer
847 views

nmap shows strange open ports

Running nmap on my localhost shows me strange open ports: $ nmap -p- localhost Starting Nmap 6.47 ( http://nmap.org ) at 2015-12-28 12:14 CET Nmap scan report for localhost (127.0.0.1) Host is up (0....
1
vote
2answers
4k views

Port-scanning on Cisco router with Nmap

I have Cisco 2911 router just booted with factory settings and no ACLs or NAT configured. All I did is turned on the interfaces and assigned IPs. I am trying to scan for open ports with Nmap, but the ...
2
votes
1answer
3k views

NMAP (or other) continuous port scan until it returns open?

Is there a way with nmap or anything else to do a continuous port scan, say on port 22, until the service comes up and the port is coming back as open? Kind of like you may have an infinite ping ...
2
votes
1answer
2k views

Windows Filtering Platform dropping SQL Server connections

I've been investigating connection issues between my web server (Web01) and a database server (Database01). My current setup: Web01 - two NICs, one external (firewalled), one internal (not firewalled)...
2
votes
1answer
172 views

How to test iptables settings by port scanning? [closed]

I want to test my iptables and prove that it only allows traffic for given Protocol / Port - combinations. How I can use as a target for a port scan?
1
vote
1answer
66 views

Port 1434 - Company Website hosting blocking us

We have a small network setup on a Windows Domain. We also have a company website that has the same domain name - but is actually not in any way on the domain - it's hosted elsewhere on a cheapo ...
0
votes
0answers
71 views

outlook doing remote portscanning

A while ago I switched my mailbox on another domain and configured outlook with an exchange server on that domain. Recently for some strange reason my hosting provider has been complaining that ...
9
votes
4answers
26k views

Is there a way to see what is actually filtering TCP port communication?

nmap -p 7000-7020 10.1.1.1 Will output all the filtered ports Starting Nmap 6.40 ( http://nmap.org ) at 2015-03-04 12:18 EET Nmap scan report for 10.1.1.1 Host is up (0.00091s latency). PORT ...
0
votes
1answer
2k views

How do I open specific ports on Linux (an AWS instance of RHEL v. 7)? [duplicate]

I'm using RedHat version 7. My AWS instances are in a security group with ample permissions for inbound connectivity. I can do Yum updates. The servers can ping each other. I can transfer files ...
-1
votes
1answer
276 views

Check my own servers for vulnerabilities [closed]

We are a small early stage startup with not so much money to spend. We have less than 3 servers that we want to monitor for security issues. Our website is essentially on one server having: Ubuntu ...
-2
votes
1answer
607 views

How do I know how the hacker gained access to my machine? [duplicate]

I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
1
vote
2answers
791 views

Linux/Bash: Test if my server is opened to the Internet programmatically/via CLI [closed]

RHEL 6 and Bash. It would be easy if I had a remote server to just run nmap from, or even curl/wget, but I only have access to servers on our side of the firewall. I know I can manually check ...
-2
votes
1answer
871 views

Hiding services from port scan

Upon running a port scan on my server: 22/tcp open ssh (protocol 2.0) 80/tcp open http nginx 1.4.6 (Ubuntu) 443/tcp open http nginx 1.4.6 (Ubuntu) 3000/tcp open ppp? 3001/tcp open ...
2
votes
1answer
316 views

Service pn-requester (2717) port information

I have not found big information on the internet about what does this service and for what is used. I apreciate if someone can explain to me a little. Thank you
0
votes
2answers
165 views

iptables settings open ports

ipables configuration Trying to allowing connection to a server from the outside world. Port scanners are reporting the ports are not open. Just after confirmation my iptables are correctly set. ...
1
vote
2answers
232 views

Server sending packets every 5 minutes to 3 IPs

Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling ...
3
votes
1answer
498 views

Scan SSH for offered authentication options

I'd like to scan our network (IPv4 and IPv6) for ssh and find the offered authentication options. Ultimately I'd like to end up with a parseable list[1] of hosts that contains the following info: IP ...
1
vote
1answer
1k views

Snort, Portscans and Scanned IP Range field

According to manual.snort.org, TCP Portscans goes from one computer to other one, but when you take a look to an tcp portscan alert in snort/snorby you can see this: In one hand: Source: 136.238.4....
-5
votes
1answer
459 views

Is it possible to detect the original IP performing a port scanning to a public service through a VPN server? [closed]

I am performing a port scanning with NMAP from my laptop to some public services on Internet... I am using a VPN service, therefore my port scanning goes through VPN server and later hits the machines ...
1
vote
1answer
675 views

Why does scanlogd miss port scans?

I am running scanlogd to detect port scans. I have observed the following to generate a log message in /var/log/syslog. When I use zenmap (nmap gui) to port scan this system from another computer on ...
3
votes
2answers
23k views

What is msrpc needed for on a Windows 7 workstation

I just ran an nmap scan against our network, and many Windows 7 machines have several high ports listening with Microsoft Windows RPC. Example: Port Serv Process name 49152, msrpc [wininit.exe] ...
0
votes
1answer
3k views

How to detect my server is used as a port scanner? [duplicate]

My Web Server is running Ubuntu 12.04.2 LTS with all security updates installed. It is used as a Web Proxy server that handles incoming requests on HTTP/80 HTTPS/443 but also retrieves web content ...
1
vote
2answers
3k views

pfSense and Snort: unexpected portscan traffic on interface

I have a pfSense box acting as my public facing router and stateful firewall. There is 1 WAN interface and several LAN interfaces using private IPs behind NAT. I EXPECT to see portscans or all kinds ...