Home / ubuntu / Questions / 1255192
In Process
WizardUrine
Asked: 2020-07-01 12:35:56 +0800 CST

Nmap port scan shows all 65000 ubuntu (20.04) ports closed

  • 772

Forgive me if this is a stupid question, I'm currently messing around with nmap / metasploit for educational purposes. I got a bit sick of using metasploitable OS so I thought I'd have a bit of fun and see if I can do any damage to my home OS (ubuntu 20.04) however when I run an nmap scan of my own machine it shows 0 open ports, even if I use -p- to scan all 65,000 of the buggers. One of them is bound to be open right? But nope. Below is the response I get from nmap

nmap scan = nmap -sV -p- ***.***.***.***
nmap results = All 65535 scanned ports on hostname (ip address) are closed

I can't think of any logical reason why all these ports would be showing as closed. I'm pretty new to ubuntu and even newer to the tools I'm using at the moment so I think I may be fundamentally misunderstanding something somewhere? Many thanks in advance for any input

networking nmap port-forwarding scanner

1 Answers

  1. The nmap needs the ping feature enabled in the firewall that it can recognize a host. If the host does not respond to "ping probes" it will usually reported as down.

    $ nmap -sV -p- 4.2.2.1

Starting Nmap 7.40 ( https://nmap.org ) at 2020-06-30 21:58 WEST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.38 seconds

    But when you enable the -Pn flag the to disable the normal "ping probe" behaviour it is able to scan the host:

    $ nmap -Pn 4.2.2.1

Starting Nmap 7.40 ( https://nmap.org ) at 2020-06-30 21:59 WEST
Nmap scan report for a.resolvers.level3.net (4.2.2.1)
Host is up (0.090s latency).
Not shown: 999 filtered ports
PORT   STATE SERVICE
53/tcp open  domain

Nmap done: 1 IP address (1 host up) scanned in 9.64 seconds

    Now that you find all ports blocked might be that the host is blocking your "nmap host" where you run the scan.

    Or the scanned host might recognize the "nmap probe pattern" and just ignore it.

    • 1