2

An excerpt from the output of netstat:

tcp4       0      0  192.168.2.48.49620     stackoverflow.co.https ESTABLISHED
tcp4       0      0  192.168.2.48.49554     stackoverflow.co.https ESTABLISHED
tcp4       0      0  192.168.2.48.49520     stackoverflow.co.https ESTABLISHED
tcp4       0      0  192.168.2.48.49517     stackoverflow.co.https ESTABLISHED
tcp4       0      0  192.168.2.48.49424     stackoverflow.co.https ESTABLISHED
tcp4       0      0  192.168.2.48.49227     stackoverflow.co.https ESTABLISHED

However, in the output of sudo nmap -p- 192.168.2.48, none of these ports are listed. What is the problem? Why doesn't nmap show all open ports?

Improve this question
6
  • 4
    Those ports appear to be outbound connections and thus there would be no process accepting connections on those ports. Commented May 17, 2016 at 18:36
  • @AndrewHenle Is there a way to scan outbound connections then? Commented May 17, 2016 at 18:36
  • You could possibly monitor the network with something like Wireshark. Given enough time, you should pick up your Established connections as traffic flows. This, of course, would only work on a local network. Commented May 17, 2016 at 18:38
  • Also, your local address is rfc1918 and can't reach stackoverflow or other public without being NATted, usually by whatever device provides your public connectivity. The NAT device necessarily knows all connections (and UDP quasiconnections) it handles, which includes all public ones you make, and depending on the device may show them to you. Commented May 17, 2016 at 23:58
  • @Utku Is there a way to scan outbound connections then? You found them with netstat, right? Commented May 18, 2016 at 11:39

1 Answer 1

Reset to default
1

You should use the unhide-tcp tool :

unhide-tcp is a forensic tool that identifies TCP/UDP ports that are listening but are not listed in /bin/netstat through brute forcing of all TCP/UDP ports available.

To install it open the terminal and type the follwing command:

sudo apt-get install unhide

To scan run:

unhide-tcp

Why doesn't nmap show all open ports?

According to nmap.org: >By default, Nmap scans the most common 1,000 ports for each protocol.

The question states that -p- option is used. So it must have another reason.

Improve this answer
1
  • I will look into unhide-tcp. But the reason nmap not showing these ports is not the one you have provided. I have used -p- option in nmap. It is in the question. Commented May 18, 2016 at 9:22

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.