With default parameters, if at least 7 priviliged ports are hit within 3 seconds, it is classified as a port scan.REQUESTS_HI = number of requests to privileged (1024 to 65535) ports within last delay seconds REQUESTS_LOW = number of requests to priviliged (0 to 1024) ports within last delay seconds Lo_ports_weight * REQUESTS_LOW + hi_ports_weight * REQUESTS_HIGH >= threshold If requests from a single IP have gained a value more than threshold in delay seconds, then the IP is classified as a port scanner. Weight of the packet with privileged (1024) destination port. -psd-lo-ports-weight weight, default value: 3.-psd-delay-threshold delay, default value: 300 (3 seconds)ĭelay (in hundredths of second) for the packets with different destination ports coming from the same host to be treated as possible port scan subsequence.Total weight of the latest TCP/UDP packets with different destination ports coming from the same host to be treated as port scan sequence. -psd-weight-threshold threshold, default value: 21.It is used on some linux-based commercial routers as well. For example to scan all possible 65535 ports (except port number 0):Īnti-scanning techniques iptables PSD module In addition, it is possible to specify all ports before/after given one by skipping the starting/ending port when using a dash. To specify a different number of common ports:ĭashes and commas work just like in #Specifying the target. open|filtered - the port is either open or filteredīy default Nmap scans the 1000 most popular ports found in /etc/nmap/nmap-services.closed|filtered - the port is either closed or filtered.open|closed ( unfiltered) - the port is either open or closed.These are used when Nmap cannot reliably determine the state but suspects two of the three possible states: In addition to these there are 3 more states that Nmap can classify a port. This can be due to restrictive firewall rules, which 'drop' a packet without sending a reply filtered - the host doesn't reply at all.closed - the host replies with an 'error: no program listening on this port' reply to requests to this port.open - there is a program listening and responding to requests on this port.There are 3 main states a port can be in: Pn is useful when the machine is heavily firewalled, TCP 80 and 443 ports and IGMP requests are blocked, but the IP address might still have a machine listening on other less common ports. Nmap uses different kinds of ping packets when run with user or root privileges and when scanning the same or different subnets: This will cause Nmap to ping every one of the specified addresses and then report the list of hosts which did respond to the ping. To instruct Nmap to only perform ping scan: Nmap performs ping scan by default before port scan to avoid wasting time on hosts that are not even connected. Ping scanning (host discovery) is a technique for determining whether the specified computers are up and running. When running as user, connect scan is used. When running as root, SYN stealth scan is used. Scans the host(s)'s top 1000 most popular ports.This is equivalent to -PA -PE (to disable, pass -PN) Ping scanning using TCP ACK:80 and ICMP.The IP address is reverse-DNS resolved to domain name, or vice-versa in case a domain name is specified (to disable, pass -n).If you specify only an IP address or domain name and no other options: List scan simply prints the specified addresses without sending a single packet to the target. The list scan option ( -sL) is useful for making sure that correct addresses are specified before doing the real scan: Note: The ending 0 in the above example does not have an effect: nmap 10.1.1.0/24 and for example nmap 10.1.1.134/24 commands are the same.

Nmap zenmap gui free download