Nmap repeats the scan to a specific port multiple time

network-monitoringnmapwireshark

I scanned a subnet (16 hosts) while dumping the network traffic with wireshark.
I did it 2 times and I noticed that in the traffic there is the normal SYN-SYN/ACK and SYN-RST from open/closed port, but also there are thousands of SYN-SYN/ACK (and ACK for closing connections) from a specific port (first scan was port 111, second scan was port 22).

Why is nmap opening all this connection to the same port on multiple hosts multiple time?

The lenght of the packet is always the same: 78.

Thanks,

Filippo

edit: the command I run was:

nmap -vv -P0 -sT -O -T5 -p 1-65535 -iL target.txt -oX target.xml

Best Answer

I answered this question on StackOverflow but the short answer is that it's a heartbeat Nmap uses to monitor network congestion.

Related Topic