random ports

thatsme · 08-01-2002, 12:37 PM

I run Slackware 8.1 (2.2.21+Owl) ...
When i run nmap like:
nmap 127.0.0.1
i see only my open ports, but run nmap one, after one (Up arrow + Enter, Up arrow + Enter) i saw that sometimes (one for ~7scans) thats i have open one port more. After another scan this port disapered ... This ports are random, and i don't think that this is some trojan, or somthing like that, because this same situation i have station witch have never been connected to some network ...
But why i see this ports

neo77777 · 08-02-2002, 08:37 AM

It might glitch, try namp --help to see what nmap really is. It is very powerful tool, needless to say you can use decoys to desguise yourself from the target machine,
run nmap with -p option in this case you can specify the range of ports to be scanned, and one more point - nmap accuracy is very high when you run it against a remote machine. If you were on the network I'd have suggested to scan this particular machine from another machine on the network, but you said there is no networking. Are connecting to the net with this system? If so then there is more if's:

Code:

if (machine.is_connected_to_net()){
  if (there_is_a_remote_machine_available())
   scan_your_machine_from_the_remote_location();
  else 
    find_a_remote_machine()
}
else 
 there_is_nothing_to_worry_about=true;

thatsme · 08-02-2002, 11:15 AM

Machine witch i have scan now is connected to net, but to scan i used loopback(127.0.0.1) - not remote scan ... hmm, i know how much powerful tool is nmap, but nmap 127.0.0.1 is example of /etc/services range TCP connect() portscan ... still i dont know why sometimes i se open ports ..

this is example:

-------------------------------------------------
Starting nmap V. 2.54BETA30 ( www.insecure.org/nmap/ )
Interesting ports on localhost (127.0.0.1):
(The 1542 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
53/tcp open domain
110/tcp open pop-3
113/tcp open auth
953/tcp open rndc
------------------------------------------------
after 8 'fast' scans (short time betwen them - using UpArrow)i see normal ports + something new:
-----------------------------------------------
1440/tcp open eicon-slp
-----------------------------------------------
after another fast scan i don't see 1440, but there is new:
-----------------------------------------------
2605/tcp open bgpd
-----------------------------------------------
after this i wait maby one second and i make new scan and now i see only my normal ports ...
maby machine is too slow p120+seti+4*Screen+and much more, and that's why sometimes it showr open ports even if they aren't =/