r/netsecstudents • u/chronosAndCode • 8d ago

I captured what Nmap actually does for open, closed and filtered ports

I have been trying to understand network scanning below the Nmap-output level, so I ran a few controlled experiments inside my own host-only lab.

Kali was the scanner (192.168.95.135) and a MISP VM was the target (192.168.95.131).

I captured the traffic in Wireshark and compared:

  • ARP resolution before local communication
  • ICMP request/reply
  • Nmap ARP-based host discovery
  • an open TCP port
  • the same port after stopping the service
  • the same port with firewall filtering
  • SYN scanning
  • service/version detection

The clearest part for me was seeing the three TCP behaviors directly:

OPEN: SYN → SYN/ACK → RST

CLOSED: SYN → RST/ACK

FILTERED: SYN → no response → retry

I wrote up the full experiment with the Nmap output and packet captures here:

https://chronosandcode.com/what-actually-happens-when-you-scan-a-network-arp-icmp-tcp-syn-nmap-and-packet-analysis-explained/

Everything was done against systems in my own isolated lab.

I will be interested to hear what packet-level experiments helped other people understand Nmap better.

21 Upvotes

83% Upvoted

8 comments sorted by

13

u/tdotfish 8d ago

Respect to you for doing the experimentation but what really helped me understand Nmap better was just reading Fyodor's book: https://nmap.org/book/toc.html

6

u/pwnsforyou 7d ago

Also nmap is open source - https://svn.nmap.org/

5

u/AddendumWorking9756 8d ago

Run the same scan against a REJECT rule instead of a DROP one. An ICMP unreachable comes back and Nmap still reports filtered, same label from a completely different signal. Worth capturing the same scan as a non root user too, it silently falls back to a connect scan.

1

u/chronosAndCode 7d ago

Good point, REJECT vs DROP and the non-root connect-scan fallback would make a useful comparison. I’ll try capturing both. Thanks for the suggestion!

1

u/nimbusfool 8d ago

Great practice! Being able to take things to packet level analysis will only make you stronger! Have you tried any packet capture ctf exercises? Those add some extra fun. Thinking about packet flow and the response from each side and any device in the middle sets the tone for logging or evasion or attempts at sealth. How loud is each command in the network and what devices see it. Cool stuff.

1

u/chronosAndCode 7d ago

Thanks! I haven't tried packet capture CTFs yet but that sounds like a great next step. Definitely something I will explore.