1 1 00:00:00,480 --> 00:00:02,163 Nmap port states. 2 2 00:00:03,030 --> 00:00:05,520 Now, as I mentioned, when you conduct your scan 3 3 00:00:05,520 --> 00:00:08,100 you're going to be scanning a host and fingerprinting it 4 4 00:00:08,100 --> 00:00:10,320 and to identify what ports may be open 5 5 00:00:10,320 --> 00:00:12,000 or which ones may be closed. 6 6 00:00:12,000 --> 00:00:13,710 Now, there's lots of different port states 7 7 00:00:13,710 --> 00:00:16,500 and you have to understand these as a cyber defender. 8 8 00:00:16,500 --> 00:00:18,210 This is important because these different states 9 9 00:00:18,210 --> 00:00:20,670 can tell you what that port is capable of doing 10 10 00:00:20,670 --> 00:00:23,010 and whether or not you have a vulnerability. 11 11 00:00:23,010 --> 00:00:24,810 Now, the first three of these are known as 12 12 00:00:24,810 --> 00:00:27,090 open, closed, and filtered. 13 13 00:00:27,090 --> 00:00:28,680 Let's take a look at each of these. 14 14 00:00:28,680 --> 00:00:30,390 First we have open. 15 15 00:00:30,390 --> 00:00:32,250 Now open is when an application of the host 16 16 00:00:32,250 --> 00:00:34,140 is ready to accept connections. 17 17 00:00:34,140 --> 00:00:35,730 So if I'm running a web server, 18 18 00:00:35,730 --> 00:00:37,170 port 80 should be open 19 19 00:00:37,170 --> 00:00:39,060 because I need to be open and listening 20 20 00:00:39,060 --> 00:00:41,490 and ready to accept a connection from whatever client 21 21 00:00:41,490 --> 00:00:43,800 wants to get access to my web server. 22 22 00:00:43,800 --> 00:00:45,840 But if I'm not running something like Telnet 23 23 00:00:45,840 --> 00:00:48,240 then port 23 should not be open. 24 24 00:00:48,240 --> 00:00:49,830 And that brings us to our second state, 25 25 00:00:49,830 --> 00:00:51,450 which is known as closed. 26 26 00:00:51,450 --> 00:00:53,220 This is when the port responds to probes 27 27 00:00:53,220 --> 00:00:55,140 by sending a reset packet. 28 28 00:00:55,140 --> 00:00:56,820 That means there's no application available 29 29 00:00:56,820 --> 00:00:58,440 to accept connections there. 30 30 00:00:58,440 --> 00:01:01,710 So again, if I have a web server and it's not running Telnet 31 31 00:01:01,710 --> 00:01:04,230 it's not going to have port 23 open. 32 32 00:01:04,230 --> 00:01:07,380 So if I send a packet to it and say, is port 23 open, 33 33 00:01:07,380 --> 00:01:08,670 I want to make a connection, 34 34 00:01:08,670 --> 00:01:11,040 it's going to send back a reset packet that says, 35 35 00:01:11,040 --> 00:01:12,570 this port is closed. 36 36 00:01:12,570 --> 00:01:15,570 You know, there is no application installed on that system 37 37 00:01:15,570 --> 00:01:17,340 for that particular port. 38 38 00:01:17,340 --> 00:01:20,430 Now, the third category we have is what's known as filtered. 39 39 00:01:20,430 --> 00:01:23,460 Now, filtered occurs when Nmap can't probe the port 40 40 00:01:23,460 --> 00:01:25,830 but it doesn't necessarily know that it's closed. 41 41 00:01:25,830 --> 00:01:28,500 This is usually due to a firewall blocking the scan 42 42 00:01:28,500 --> 00:01:30,030 on the network or host. 43 43 00:01:30,030 --> 00:01:31,350 And so when you see filtered, 44 44 00:01:31,350 --> 00:01:32,760 the first thing you should be thinking 45 45 00:01:32,760 --> 00:01:34,590 as somebody who's scanning this network is 46 46 00:01:34,590 --> 00:01:36,330 there's a firewall in place. 47 47 00:01:36,330 --> 00:01:38,310 And so that brings us to other states 48 48 00:01:38,310 --> 00:01:39,960 that could be shown as well. 49 49 00:01:39,960 --> 00:01:42,180 There are three other states that are displayed 50 50 00:01:42,180 --> 00:01:45,330 if the scan cannot determine a reliable result. 51 51 00:01:45,330 --> 00:01:47,100 Again, filtered is one result 52 52 00:01:47,100 --> 00:01:48,570 where we're sure there's a firewall 53 53 00:01:48,570 --> 00:01:50,850 but there's other ones when we're not so sure. 54 54 00:01:50,850 --> 00:01:54,870 These are Unfiltered, Open/Filtered, and Closed/Filtered. 55 55 00:01:54,870 --> 00:01:57,480 Now, Unfiltered is when Nmap can probe the port 56 56 00:01:57,480 --> 00:02:00,030 but it can't determine if it's open or closed. 57 57 00:02:00,030 --> 00:02:02,520 It's not filtered, it's not being blocked by a firewall 58 58 00:02:02,520 --> 00:02:04,920 but I'm really not sure if it's open or closed. 59 59 00:02:04,920 --> 00:02:07,290 I know this sounds kind of weird, and it really is. 60 60 00:02:07,290 --> 00:02:08,760 It is not very common to find 61 61 00:02:08,760 --> 00:02:12,300 ports labeled as unfiltered in your Nmap scans. 62 62 00:02:12,300 --> 00:02:14,220 Next we have Open/Filtered. 63 63 00:02:14,220 --> 00:02:16,350 Now this happens when Nmap can't determine 64 64 00:02:16,350 --> 00:02:20,010 if the port is open or filtered, so it's one or the other. 65 65 00:02:20,010 --> 00:02:22,740 So when it does its UDP or IP protocol scan 66 66 00:02:22,740 --> 00:02:26,010 this is pretty common that it'll come back Open/Filtered. 67 67 00:02:26,010 --> 00:02:28,800 If you're using a SIN scan, it should actually tell you 68 68 00:02:28,800 --> 00:02:30,720 whether or not it was open or filtered. 69 69 00:02:30,720 --> 00:02:33,660 It can determine that based on the response from the server. 70 70 00:02:33,660 --> 00:02:35,730 Now, the third one we have is Closed/Filtered 71 71 00:02:35,730 --> 00:02:37,290 and this is when Nmap can't determine 72 72 00:02:37,290 --> 00:02:39,060 if the port is closed or filtered 73 73 00:02:39,060 --> 00:02:41,490 when conducting the TCP Idle scan. 74 74 00:02:41,490 --> 00:02:44,940 So if you're conducting a TCP Idle scan using dash TI, 75 75 00:02:44,940 --> 00:02:47,670 you may get back something that shows Closed/Filtered. 76 76 00:02:47,670 --> 00:02:50,130 Again, these three are not nearly as common 77 77 00:02:50,130 --> 00:02:52,140 as the open, closed and filtered, 78 78 00:02:52,140 --> 00:02:53,910 but they are important to know. 79 79 00:02:53,910 --> 00:02:55,650 Now, why is it important for us to know 80 80 00:02:55,650 --> 00:02:57,480 all these different port states? 81 81 00:02:57,480 --> 00:02:58,770 Well, as a cyber defender 82 82 00:02:58,770 --> 00:03:00,450 it's important for us to understand this 83 83 00:03:00,450 --> 00:03:02,910 because an open port indicates a host 84 84 00:03:02,910 --> 00:03:04,590 that is ready to accept connections. 85 85 00:03:04,590 --> 00:03:06,720 That means there might be a vulnerability there 86 86 00:03:06,720 --> 00:03:08,820 because there's an inbound connection that's open. 87 87 00:03:08,820 --> 00:03:11,040 If you have a web server and port 80 is open 88 88 00:03:11,040 --> 00:03:12,660 that's not really a vulnerability 89 89 00:03:12,660 --> 00:03:14,400 because you know that port 80 is open 90 90 00:03:14,400 --> 00:03:16,350 'cause it's a web server, you're expecting that. 91 91 00:03:16,350 --> 00:03:18,120 But if I do a scan against your host 92 92 00:03:18,120 --> 00:03:20,130 inside your network for your work stations, 93 93 00:03:20,130 --> 00:03:21,840 and I find port 80 is open, 94 94 00:03:21,840 --> 00:03:23,490 that is something that I'm going to look into. 95 95 00:03:23,490 --> 00:03:25,050 That is a vulnerability to me 96 96 00:03:25,050 --> 00:03:27,060 because most people aren't running web servers 97 97 00:03:27,060 --> 00:03:28,170 on their desktops. 98 98 00:03:28,170 --> 00:03:29,520 It's just not that common. 99 99 00:03:29,520 --> 00:03:31,830 And so by going through and doing these port scans 100 100 00:03:31,830 --> 00:03:33,420 and looking at these port states, 101 101 00:03:33,420 --> 00:03:35,640 it can tell you what you need to look further into 102 102 00:03:35,640 --> 00:03:38,400 as a network defender to be able to harden down your network 103 103 00:03:38,400 --> 00:03:40,050 and minimize your attack surface.