NMap (client on Mac) port scan on Ubuntu server

Question

I have to scan a Ubuntu server (installed as a virtual machine on my Mac) for open ports. I used the netcat utility and it shows a nice list of all the open ports on my virtual machine. However, when I use NMap, it is giving me some strange results.

Using Netcat:

nc -z 192.168.1.10 1-1023Connection to 192.168.1.10 22 port [tcp/ssh] succeeded! Connection to 192.168.1.10 25 port [tcp/smtp] succeeded! Connection to 192.168.1.10 53 port [tcp/domain] succeeded! Connection to 192.168.1.10 80 port [tcp/http] succeeded! Connection to 192.168.1.10 110 port [tcp/pop3] succeeded! Connection to 192.168.1.10 139 port [tcp/netbios-ssn] succeeded! Connection to 192.168.1.10 143 port [tcp/imap] succeeded! Connection to 192.168.1.10 445 port [tcp/microsoft-ds] succeeded! Connection to 192.168.1.10 993 port [tcp/imaps] succeeded! Connection to 192.168.1.10 995 port [tcp/pop3s] succeeded!

Command 1:
nmap -sP -vv --packet-trace 192.168.1.10
Result: Nmap scan report for 192.168.1.10 Host is up (0.00096s latency). Read data files from: /usr/local/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds

Command 2:
sudo nmap -sF -v -r 192.168.1.10

Results: Starting Nmap 5.51 ( http://nmap.org ) at 2011-10-30 17:27 EDT Initiating Ping Scan at 17:27 Scanning 192.168.1.10 [4 ports] Completed Ping Scan at 17:27, 3.02s elapsed (1 total hosts) Nmap scan report for 192.168.1.10 [host down] Read data files from: /usr/local/share/nmap Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 3.15 seconds Raw packets sent: 8 (304B) | Rcvd: 0 (0B)

When I tried to run NMap on a Windows Client with a similar setup (Ubuntu server running on a VM), the 2nd command worked fine. Can some one please explain the paradox between the outputs of command 1 and command 2 on a Mac?

Answer 1

Have you tried supplying '-P0' or '-Pn' to the command line arguments? I'm not familiar with Macs but it might be blocking the ping probes, which causes nmap to abort immediately.

Whether or not nmap adds in firewall rules by itself when it's installed on Windows is also a possibility, hence why you don't see the same results.