LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 11-15-2011, 10:20 AM   #1
android-eve
Member
 
Registered: Dec 2010
Posts: 36

Rep: Reputation: 1
Why does NMAP report “Host seems down” despite host responding to ping?


I am trying to test a new CentOS 6 server on my tiny LAN. From another Linux (Ubuntu 10.04) host I type:

Code:
androideve@ubunbtu10:~$ nmap 192.168.1.3

Starting Nmap 5.00 ( http://nmap.org ) at 2011-11-15 09:31 EST
Note: Host seems down. If it is really up, but blocking our ping probes, try -PN
Nmap done: 1 IP address (0 hosts up) scanned in 0.04 seconds
This is despite the fact that if I ping it manually, there isn't any problem:

Code:
androideve@ubunbtu10:~$ ping 192.168.1.3
PING 192.168.1.3 (192.168.1.3) 56(84) bytes of data.
64 bytes from 192.168.1.3: icmp_seq=1 ttl=64 time=0.161 ms
64 bytes from 192.168.1.3: icmp_seq=2 ttl=64 time=0.138 ms
64 bytes from 192.168.1.3: icmp_seq=3 ttl=64 time=0.147 ms
64 bytes from 192.168.1.3: icmp_seq=4 ttl=64 time=0.131 ms
Why is this happening? How to fix this?
 
Old 11-16-2011, 02:58 AM   #2
fukawi1
Member
 
Registered: Apr 2009
Location: Melbourne
Distribution: Fedora & CentOS
Posts: 854

Rep: Reputation: 189Reputation: 189
Did you try using -PN?

Quote:
HOST DISCOVERY:
-PN: Treat all hosts as online -- skip host discovery
Code:
man nmap
 
Old 11-16-2011, 08:29 AM   #3
android-eve
Member
 
Registered: Dec 2010
Posts: 36

Original Poster
Rep: Reputation: 1
Lightbulb

Quote:
Originally Posted by fukawi1 View Post
Did you try using -PN?
Thanks for this tip. I just tried it and NMAP responds that all "All 1000 scanned ports on 192.168.1.3 are filtered"
Code:
androideve@ubuntu10:~$ nmap -PN 192.168.1.3

Starting Nmap 5.00 ( http://nmap.org ) at 2011-11-16 09:20 EST
All 1000 scanned ports on 192.168.1.3 are filtered

Nmap done: 1 IP address (1 host up) scanned in 6.89 seconds
I understand that this has to do with the firewall on the remote (scanned) host, but the main reason I am trying to use NMAP is to see which ports on the remote host are open and whether it is at all ping-able.

Well, I can ping it using 'ping' but not using NMAP. I find this very confusing.

Furthermore, the iptables firewall on the remote host has SSH checked as a Trusted Service ("accessible from all hosts and networks"). Why didn't NMAP detect this?

UPDATE: It turns out that when I last scanned the CentOS 6 remote host, it was in sleep mode. When I woke it up and tried NMAP again, I received:

Code:
android-eve@ubuntu10:~$ nmap -PN 192.168.1.3

Starting Nmap 5.00 ( http://nmap.org ) at 2011-11-16 11:11 EST
Interesting ports on 192.168.1.3:
Not shown: 999 filtered ports
PORT   STATE  SERVICE
22/tcp closed ssh

Nmap done: 1 IP address (1 host up) scanned in 4.97 seconds
So, at least I see some consistency between the firewall setting and what NMAP reports.

I am still confused by NMAP not reporting a perfectly ping-able host. If I were to rely on NMAP for verifying that my host is 100% stealthed, it would have mislead me.

What am I missing about the correct usage of NMAP?

Last edited by android-eve; 11-16-2011 at 10:21 AM. Reason: update
 
Old 11-16-2011, 11:45 AM   #4
lleb
Senior Member
 
Registered: Dec 2005
Location: Florida
Distribution: CentOS/Fedora
Posts: 2,505

Rep: Reputation: 446Reputation: 446Reputation: 446Reputation: 446Reputation: 446
that tells you the port 22 is closed and not open. it all depends on how the firewall is configured on the other end. you can also use nmap -P0 to get past the "ping issue"

for just testing a specific port nmap -p<port number here> IP will be much faster then just nmap -PN or -PO
 
Old 11-17-2011, 12:53 AM   #5
fukawi1
Member
 
Registered: Apr 2009
Location: Melbourne
Distribution: Fedora & CentOS
Posts: 854

Rep: Reputation: 189Reputation: 189
In my experience, and I am not a nmap guru by any means.
Filtered ports mean the firewall is rejecting packets

Closed ports, mean the firewall is dropping packets.

Last edited by fukawi1; 11-17-2011 at 02:19 AM.
 
Old 11-21-2011, 02:35 PM   #6
android-eve
Member
 
Registered: Dec 2010
Posts: 36

Original Poster
Rep: Reputation: 1
Lightbulb

Quote:
Originally Posted by fukawi1 View Post
Filtered ports mean the firewall is rejecting packets

Closed ports, mean the firewall is dropping packets.
It's actually the opposite.
 
1 members found this post helpful.
  


Reply

Tags
firewall, nmap, ping


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Forwarding ping packets from one 1st host to 2nd host via 2rd host sachee Linux - Networking 1 09-25-2011 01:51 PM
[SOLVED] Ping from Vmware host to Virtual Box host greatcyrus Linux - Virtualization and Cloud 7 03-09-2011 02:03 AM
Bind9 ,host does reslove a dns name but ping says unknown host Byenary Linux - Networking 10 01-12-2011 01:33 AM
Debian 5 , after SysCp Installation and configure Ping Valure ( ping: unknown host ) brenner23 Linux - Networking 1 07-14-2010 09:01 PM
Unknown Host <Linuxmachinename> / Unable to ping by host name nishi_k_79 Linux - Networking 4 11-01-2003 01:24 PM


All times are GMT -5. The time now is 07:29 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration