Nmap Port Specification
So here we are in port specification and scanning order.
And there is actually quite a lot of options here.
And the main switch is the -P and you can see here, it's giving us some examples of how you can use -P. Now, let me go into this tab here.
And what I'll do is I'll go through.
A selection of how you can use this -P to do port specification and port ranges.
So as we can see here, we've got Nmap, we got, target -B.
You can see what's going on.
And then this main switch here, which is -P, and this is the first thing that we're doing, and this is the range essentially.
So we're looking at port 21 through to port 1000.
There we go. It's running, it's scan and that is done.
So we can see that 974 port scanned.
So that's our range.
And then we can get a little bit more complicated.
We get onto our -P as usual, and then we can invoke the UDP and then colon.
And then the port that we want to go. 53, 1 1 1, 1 3 7, 5353.
And then we can also include optionally TCP ports, and we don't just need to list them individually.
We can put a range in there.
So 21 to 25 in that 80,1 3 5, 8080 now also, note we've got the switches in here.
Why have we got these here? Well, obviously, or maybe not so obviously, but if you don't have, or tell it to do a UDP scan, it won't automatically do this check here, check for these.
So we've got to tell it to look for those UDP ports or do a UDP port scan so that it will actually select those.
And we're also telling it to do a SYN scan, which it would do.
Automatically anyway, but we could tell it to do a connect scan or something like that as well.
So let's try that one and we can see there.
It's showing us our closed TCP ports are open.
TCP ports are closed UDP ports and open UDP ports as based on this command.
So let's carry on and we can do -P minus.
This means it will cover all ports.
And we can also specify the name of the service and interesting.
What you'll see here is we've got https. So that means it won't just look for 80 it'll look for anything that is registered in the Nmap database as http. And that of course is available.
And you can see in this instance, you've got 8 0, 0 8 coming up.
So that's the -P and then the name of the actual protocol. Here, we've got -F.
This is what's known as fast mode and this will scan it fewer ports than the default. 1000 there, we can see that still in about a hundred ports or in fact exactly a hundred ports.
Now here, we've got -P minus. So here, leaving off the initial port in range makes Nmap scan start at port one.
So this is therefore going to do the full range one through to 65,000.
We can also do it the other way we can do -P zero minus and then leaving off the end, port in range makes Nmaps scan through to port 65,000 again, or 65,535 to be exact.
So that's another way of getting all your bill ports or another way to specify ranges.
There's also the dash dash top dash port option.
So instead of doing the top 1000 ports, it'll do the whatever number you've specified.
So here we've put 2000, but we could just put the top 100 ports.
So this is going to do twice, as many as it normally does as returning our results there.
Now say we want to exclude some ports.
Well, we can also use the minus minus exclude minus ports.
We can specify them individually and we can also specify Rangers.
And there we go is essentially scanned after 9,000 there.
I can see the results as popped back to help.
When we haven't gone through here is a minus ACK.
It's pretty much pointless to use, but you can scan port consecutively and not randomly.
When you normally do an Nmap, scan it scans the port randomly.
But you can tell it to do 1, 2, 3, 4, and do it consecutively in order.
It's not really much of a reason to do that, but you can do it.
It will be more obvious to logs or in logs that you are doing scanning.
And there's another option here, which is the minus minus.
Port dash ratio, which scan that ports more common than, and then the ratio that you put in there.
So there you go.
That's port specification and scan order.
Plenty of options there. And as you can see, if you do a help, you can see the options.
Single port, port ranges, UDP TCP.
All which are just gone through.
And of course that one's actually got the SC TP there as well.
If you want to cover that port for SIG Tran and SS7, so there you go.
Port specification.