nmap version differences

Synesthesia · 02-22-2007, 09:28 PM

Why does nmap 3.93 turn up port "113 auth" as closed, and nmap 4.11 turn up all as filtered?

win32sux · 02-23-2007, 11:02 AM

Quote:

Originally Posted by Synesthesia

Why does nmap 3.93 turn up port "113 auth" as closed, and nmap 4.11 turn up all as filtered?

could you post the exact nmap command you used to scan the box with??

also, what does the output of these look like on the scanned box:

Code:

netstat -atn | grep "LISTEN "

Code:

iptables -L -v -n

Synesthesia · 02-23-2007, 01:57 PM

netstat -atn | grep "LISTEN" does not include the port in question (113), and iptables isn't running. When I scanned it with nmap 4.11 it was on the box itself (e.g. I did nmap 127.0.0.1). When I scanned it with nmap 3.93 it was from an external computer, but I made sure the open port was not from another computer on the network (no other computers on the ip at that time).

win32sux · 02-23-2007, 02:22 PM

Quote:

Originally Posted by Synesthesia

netstat -atn | grep "LISTEN" does not include the port in question (113), and iptables isn't running.

okay...

Quote:

When I scanned it with nmap 4.11 it was on the box itself (e.g. I did nmap 127.0.0.1).

well, i do find it kinda weird that this would give you a "filtered" result...

Code:

win32sux@candystore:~$ nmap -p 113 127.0.0.1

Starting Nmap 4.03 ( http://www.insecure.org/nmap/ ) at 2007-02-23 15:18 EST
Interesting ports on localhost (127.0.0.1):
PORT    STATE  SERVICE
113/tcp closed auth

Nmap finished: 1 IP address (1 host up) scanned in 0.112 seconds

Quote:

When I scanned it with nmap 3.93 it was from an external computer, but I made sure the open port was not from another computer on the network (no other computers on the ip at that time).

what open port?? you said it appeared as "closed" - which would make perfect sense if there's no iptables rules and nothing listening on port 113...

just curious: have you seen anything in the changelog which might explain why your 4.11 is showing 113 on localhost as "filtered"??