8

The following IP address is for my network interface

$ nmap 192.168.0.142

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-09 11:33 EST
Nmap scan report for ocean (192.168.0.142)
Host is up (0.00047s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
3306/tcp open  mysql

Nmap done: 1 IP address (1 host up) scanned in 0.97 seconds

Are those services shown below but not above exactly those that are closed to the outside but open within my local machine?

Are the services whose security that I should worry about exactly those listed above?

Thanks.

$ nmap localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-09 11:34 EST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00046s latency).
Other addresses for localhost (not scanned):
Not shown: 993 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
631/tcp  open  ipp
3306/tcp open  mysql
5432/tcp open  postgresql
9050/tcp open  tor-socks

Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds
Improve this question

3 Answers 3

Reset to default
6

If you have services that are only bound to the localhost/127.0.0.1 address, they will only show in a 127.0.0.1 nmap scan, and not in others scans to IP addresses on the same host.

Such is the case usually, for security reasons, of binding to 127.0.0.1, MySQL, postgresql and mongo DBs for only localhost use, redis and others.

Conversely, you can find sometimes other ports on non-localhost IPs, especially when you have vhosts in webservers bound to non-localhost IP addresses, and to only listen on those addresses.

On your specific 192.168.0.142 case, I would enquire wether that MySQL could not also be bound to 127.0.0.1.

PS A very old adage that I was taught when as a trainee, was: "More important than using the tools, is understanding how they work/the data we are given."

Concerning @roaima answer, as an example mentioned on this answer, the default port of a widely used DB, mongodb, is not on the list of ports scanned by default by nmap.

TLDR It is not a rule that scanning different IP addresses of the same equipment, that all the scanning data/open ports will be the same.

Alas, by network design most often than not, we do not want them to be the same. For instance in firewalls/switching equipment, we define interfaces/VLANs on a specific control network that users cannot reach for having the web management/ssh services active, and only on those interfaces. e.g. normal users cannot reach those services, they can only be reached by a VPN and/or a control room. (this is a more extreme example. I have worked in organisations where the SSH service of VMs is only present via a control network too).

Improve this answer
2
  • 1
    And even if the same port is open on different interfaces, it may not be the same service. I.e. port 443 on a public-facing interface may run your public website, 443 on an internal-facing interface may run the Git server that you use to deploy your website. Commented Mar 9, 2019 at 17:48
  • @JörgWMittag Good point. Commented Mar 9, 2019 at 17:52
5

Almost, but not quite.

By default nmap scans only 1000 ports for any given protocol (tcp, udp, whatever). So your port scans are subject to that filter. You'll see from the documentation that you can define the set of ports to be scanned with the -p option, and that -p- means scan ports 1-65535. (Strangely, port 0 is still omitted; you have to specify it explicitly if you want to include it.)

Improve this answer
6
  • Thanks. Does -p0,1-65535 scan all possible ports (for any given protocol (tcp, udp, whatever))? Commented Mar 9, 2019 at 17:11
  • The documentation I linked in my answer shows -p0- is sufficient. Commented Mar 9, 2019 at 23:45
  • -p0,1-65535 reveals 33060/tcp open mysqlx, while -p0- doesn't. What is the max possible port number? Commented Mar 10, 2019 at 17:58
  • The documentation I linked in my answer shows the range of ports is 0-65535 (inclusive). Please read it. Commented Mar 10, 2019 at 20:12
  • Is it correct that-p0-65535 mean the range from 0 to 65535, both ends included. Commented Mar 22, 2019 at 22:35
3

The other two answers both raise very important points. But in addition, you appear to have only scanned TCP and not UDP :-). So there might also be UDP services you want to worry about.

UDP scanning has a number of issues that do not apply to TCP scanning. In either case, I would start by querying the OS instead: How do I list all sockets which are open to remote machines?

Port scanning is still useful as a confirmation though. Port scanning from a different host is a particularly good idea if you have set up a firewall, to confirm that the firewall is doing what you want.

Improve this answer
9
  • And then the IPsec services ;) the possibilities, my God :) .... +1 (I am joking with serious things. Many people want true and tried recipes for some activities, and the reality is that were wont be a unique way of doing that for two different networks) Commented Mar 9, 2019 at 17:53
  • Thanks. Do you mean nmap doesn't report udp listening ports? Doe it only report tcp listening port? How do you know that? Commented Mar 10, 2019 at 22:12
  • 1
    @Tim "TCP connect scan is the default TCP scan type when SYN scan is not an option. This is the case when a user does not have raw packet privileges." Commented Mar 10, 2019 at 23:24
  • Thanks. Is it possible to specify some option so that nmap will scan all transport listening ports (at least TCP and UCP)? Commented Mar 10, 2019 at 23:27
  • Thanks. (1) Do ss and netstat report sockets, without regard to any local firewall? (2) what is your command for port scanning for TCP and UDP? For example, sudo nmap -p0-65535 -sU 192.168.1.97 have been running for a while. Commented Mar 22, 2019 at 22:46

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.