Nmap Port States- Part 3
So we've gone through a little bit on what the output is and what does it mean?
So we can see here, the state, as we go down, you can see open, open, open.
These are all open, but port's gonna have different states and I'll go through all the possible state now.
So you can understand the port state. So open the first one, an obvious one.
It means an application is actively accepting TCP connections or UDP data gram's, or SCTP associations on this port.
If you don't know what SCTP is, then don't worry about that for now.
But essentially it means that it is accepting connection.
And each open port is an avenue for attack.
A black hat wants to find an exploit, the open ports, and then under status, you may see closed a closed port is accessible in that it receives and responds to Nmap pro packets, but there is no application listening.
These close ports can be helpful in showing that a host is up because close ports are reachable and it's possible that it may be worth scanning it later in case something opens up.
But it does show us that the host is up and active, even though the state is closed.
And then under state, you may see filtered, which means Nmap cannot determine whether the port is open because some form of packet filtering prevents its probes from reaching the port.
This means the probes are filtered by some sort of maybe a dedicated firewall router rules.
ACL's a host based firewall, something like that.
Filtered Port's provide little information.
Sometimes they respond with ICM P error message such as type three, code thirteens that's like destination and reachable, but filters that simply drop probes without responding are formal.
So this forces Nmap to retry several times, just in case the probe was dropped due to network congestion, rather than filtering this slows down the scan.
And then under state, you can have unfiltered.
The unfiltered state means that the port is accessible, but Nmap is enabled to determine whether it is open or closed only the act scan, which we haven't covered yet, which we will go through, which is used to Nmap firewall rule sets.
Classifies ports.
And to this day, scanning unfiltered ports with other scan types, such as the SYN scan, which you've already mentioned.
I can help resolve with the port is open, which we will cover.
And then under state, you can have open filtered Nmap places, Ports into this state where it is unable to determine whether a port is open or filter.
This occurs for scan types in which open ports give no response.
The lack of response could also mean that the packet filter drop the probe or any response.
It received.
So Nmap does not know for sure where the port is open or being filtered, the UDP IP protocol, fin Knoll, and Xmas scans, classify ports this way.
And then you have the state you have closed filtered this day is used when Nmap is unable to determine whether a port is closed or filtered is only used for the IP I D idle scan, which we will cover later.