Nmap – Why Not Scanning All Ports

nmapport

I've noticed that nmap only scans a bunch of known ports, and the only way i've managed to check 'em all is to put a "-p 0-65535" in.

Why is that? am I wrong? is there a more popular way to scan all ports aside from what I've done?

Best Answer

By default, Nmap scans the top 1000 most popular ports, according to the statistics generated from Internet-wide scans and large internal network scans from the summer of 2008. There are a few options that change this: -F reduces the number to 100, -p allows you to specify which ports to scan, and --top-ports lets you specify how many of the most popular ports to scan. This means that the default scan is equivalent to --top-ports 1000, and -F is the same as --top-ports 100.

These numbers were set in version 4.75, and were a change from the roughly 1700 (TCP) ports that were the default in version 4.68. The purpose was to decrease scanning times while still giving reasonable results. The flexibility of Nmap's command-line options guarantees that you can still scan just about any combination of ports that you want, regardless of the defaults.

Scanning all 65536 TCP ports is still possible with -p0-, but it will take a very long time. Scanning all UDP ports with -sU -p0- will take even longer, because of the way that open ports are detected.

Related Solutions

Windows – Why do nmap -p and nmap -A scans show different results

By default, nmap only scans for "common" ports (the 1000 most common ports per protocol I believe). Since 789 is not a common port it isn't found. If you do

nmap -A -vv -p- ip

it should scan ports 1-65535.

Here is the nmap documentation that tells what ports are scanned by default: http://nmap.org/book/man-port-specification.html

Block nmap xmas scan from detecting the server’s open port

Can you be more specific about the rule that you've configured?

As you've described it, it would block an X-mas scan; a packet lit up with flags like a Christmas tree would still be a packet "sent from a particular IP" - but if that's truly how you've set up your rules, then you're likely going to unintentionally ban hosts sending legitimate traffic at a rate that violates the rule.

Don't put a lot of effort into security by obscurity. You service is open to the internet, and a scanner can simply slow their scan rate to a crawl to defeat your rate limit, or they can randomly hit the open port before the block kicks in. Blocking scans is not a substitute for securing your service.

Best Answer

Related Solutions

Windows – Why do nmap -p and nmap -A scans show different results

Block nmap xmas scan from detecting the server’s open port

Related Topic