Checking open port with nmap

[steve_roach]

Hi,

I think I have opened a port (12963) on my ADSL router (a DLink DSL-502T) but, when checking the port with nmap, it doesn't seem to be open:

----------------------------
$ nmap -v 10.1.1.3

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2007-03-03 19:34 EST
Initiating SYN Stealth Scan against 10.1.1.3 [1663 ports] at 19:34
Discovered open port 22/tcp on 10.1.1.3
Discovered open port 25/tcp on 10.1.1.3
Discovered open port 139/tcp on 10.1.1.3
Discovered open port 1521/tcp on 10.1.1.3
Discovered open port 111/tcp on 10.1.1.3
Discovered open port 445/tcp on 10.1.1.3
Discovered open port 5520/tcp on 10.1.1.3
The SYN Stealth Scan took 0.16s to scan 1663 total ports.
Host 10.1.1.3 appears to be up ... good.
Interesting ports on 10.1.1.3:
(The 1656 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1521/tcp open oracle
5520/tcp open sdlog

Nmap finished: 1 IP address (1 host up) scanned in 1.969 seconds
Raw packets sent: 1665 (66.6KB) | Rcvd: 3335 (133KB)
-----------------------------
or
-----------------------------
$ nmap -p 12963 -v 10.1.1.3

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2007-03-04 15:43 EST
Initiating Connect() Scan against 10.1.1.3 [1 port] at 15:43
The Connect() Scan took 0.00s to scan 1 total ports.
Host 10.1.1.3 appears to be up ... good.
Interesting ports on 10.1.1.3:
PORT STATE SERVICE
12963/tcp closed unknown

Nmap finished: 1 IP address (1 host up) scanned in 2.380 seconds
-----------------------------

A couple of questions;

Should I see port 12963 on the nmap list?
Should I have made any changes to iptables to accommodate this?

TIA

Steve

[daverj]

Im not clear what information you are wanting. What makes you think port 12963 is open, especially since nmap shows that it is closed. Another way of seeing if it is open is to try to telnet to it:

telnet 10.1.1.3 12963

if you get a 'connection refused' response, then it is closed.

Also, you will only see it if it is open (unless you use the -p switch). Whether it should be open for you is something we cannot answer.

davidj

[steve_roach]

The question is, is it possible that the port is open on the router but nmap shows it closed because iptables is blocking it?

Or, to put it another way, once I have opened the port, how do I check that it is actually open?

[leigh123@linux]

The question is, is it possible that the port is open on the router but nmap shows it closed because iptables is blocking it?

Or, to put it another way, once I have opened the port, how do I check that it is actually open?

If you want to scan your machine properly for open ports you should do it from another machine or use GRC

https://www.grc.com/x/ne.dll?bh0bkyd2

[savage]

I agree with leigh123, if you want to be 100% sure the port is open on the router, you need to scan the router from the Internet.

Some routers behave differently depending on whether you're accessing from inside or outside your network. E.g. If I go to my router on port 80 inside the network, I get the admin panel for the router, if you enter my routers IP address in firefox, you'll get my apache server on port 80.

Mine is a netgear, other makes/models may act differently.

Savage

[steve_roach]

Hi Guys,

Yeah, thanks for that. I used Shields Up to check the port and it is open as intended.

I guess I expected to be able to check the status of the router from the server it is attached to - obviously wrongly.

Anyhoo, it's all working fine now; the port is open on the router and I have set up iptables to route the port to one of the lan pcs. utorrent seems to be a happy bunny.

Thanks for the replies.

Steve