Instructor: Nmap port states. 2 2
Now, as I mentioned, when you conduct your scan 3 3
you're going to be scanning a host and fingerprinting it 4 4
and to identify what ports may be open 5 5
or which ones may be closed. 6 6
Now, there's lots of different port states 7 7
and you have to understand these as a cyber defender. 8 8
This is important because these different states 9 9
can tell you what that port is capable of doing 10 10
and whether or not you have a vulnerability. 11 11
Now, the first three of these are known as 12 12
open, closed, and filtered. 13 13
Let's take a look at each of these. 14 14
First we have open. 15 15
Now open is when an application of the host 16 16
is ready to accept connections. 17 17
So if I'm running a web server, 18 18
port 80 should be open 19 19
because I need to be open and listening 20 20
and ready to accept a connection from whatever client 21 21
wants to get access to my web server. 22 22
But if I'm not running something like Telnet 23 23
then port 23 should not be open. 24 24
And that brings us to our second state, 25 25
which is known as closed. 26 26
This is when the port responds to probes 27 27
by sending a reset packet. 28 28
That means there's no application available 29 29
to accept connections there. 30 30
So again, if I have a web server and it's not running Telnet 31 31
it's not going to have port 23 open. 32 32
So if I send a packet to it and say, is port 23 open, 33 33
I want to make a connection, 34 34
it's going to send back a reset packet that says, 35 35
this port is closed. 36 36
You know, there is no application installed on that system 37 37
for that particular port. 38 38
Now, the third category we have is what's known as filtered. 39 39
Now, filtered occurs when Nmap can't probe the port 40 40
but it doesn't necessarily know that it's closed. 41 41
This is usually due to a firewall blocking the scan 42 42
on the network or host. 43 43
And so when you see filtered, 44 44
the first thing you should be thinking 45 45
as somebody who's scanning this network is 46 46
there's a firewall in place. 47 47
And so that brings us to other states 48 48
that could be shown as well. 49 49
There are three other states that are displayed 50 50
if the scan cannot determine a reliable result. 51 51
Again, filtered is one result 52 52
where we're sure there's a firewall 53 53
but there's other ones when we're not so sure. 54 54
These are Unfiltered, Open/Filtered, and Closed/Filtered. 55 55
Now, Unfiltered is when Nmap can probe the port 56 56
but it can't determine if it's open or closed. 57 57
It's not filtered, it's not being blocked by a firewall 58 58
but I'm really not sure if it's open or closed. 59 59
I know this sounds kind of weird, and it really is. 60 60
It is not very common to find 61 61
ports labeled as unfiltered in your Nmap scans. 62 62
Next we have Open/Filtered. 63 63
Now this happens when Nmap can't determine 64 64
if the port is open or filtered, so it's one or the other. 65 65
So when it does its UDP or IP protocol scan 66 66
this is pretty common that it'll come back Open/Filtered. 67 67
If you're using a SIN scan, it should actually tell you 68 68
whether or not it was open or filtered. 69 69
It can determine that based on the response from the server. 70 70
Now, the third one we have is Closed/Filtered 71 71
and this is when Nmap can't determine 72 72
if the port is closed or filtered 73 73
when conducting the TCP Idle scan. 74 74
So if you're conducting a TCP Idle scan using dash TI, 75 75
you may get back something that shows Closed/Filtered. 76 76
Again, these three are not nearly as common 77 77
as the open, closed and filtered, 78 78
but they are important to know. 79 79
Now, why is it important for us to know 80 80
all these different port states? 81 81
Well, as a cyber defender 82 82
it's important for us to understand this 83 83
because an open port indicates a host 84 84
that is ready to accept connections. 85 85
That means there might be a vulnerability there 86 86
because there's an inbound connection that's open. 87 87
If you have a web server and port 80 is open 88 88
that's not really a vulnerability 89 89
because you know that port 80 is open 90 90
'cause it's a web server, you're expecting that. 91 91
But if I do a scan against your host 92 92
inside your network for your work stations, 93 93
and I find port 80 is open, 94 94
that is something that I'm going to look into. 95 95
That is a vulnerability to me 96 96
because most people aren't running web servers 97 97
on their desktops. 98 98
It's just not that common. 99 99
And so by going through and doing these port scans 100 100
and looking at these port states, 101 101
it can tell you what you need to look further into 102 102
as a network defender to be able to harden down your network 103 103
and minimize your attack surface.