> For the complete documentation index, see [llms.txt](https://notes.nomanaziz.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.nomanaziz.me/cybersecurity/penetration-testing/elearnsecurity/ejpt/footprinting-and-scanning/port-scanning.md).

# Port Scanning

### Open Port Behaviour

Syn -> Syn + Ack -> Ack

***

### Closed Port Behaviour

Syn -> Rst + Ack

***

### Nmap Version Scan (-sV) Behaviour

Syn -> SYN + Ack -> Ack -> Banner -> Rst + Ack

***

### Tcpwrapped Port Status

It means that TCP Handshake was completed but remote host closed the connection without receiving any data. It could be an indicator for **FIREWALL**.

***

### Get Reason for Open or Closed Ports

Use nmap `--reason` switch to show explanation. We may learn from it that remote host sent an `RST` packet during TCP Handshake which probably means firewall prevented the handshake.

***

### Masscan

Useful for large networks to fastly map the network. `masscan -p22,80,443,445,53,8080 -Pn --rate=800 --banners 192.168.18.0/24 -e tap0 --router-ip 192.168.18.1 --echo > masscan.conf`

* rate means 800 packets per second
* banners used to fingerprint services
* `-e` tells which network interface to use
* `-echo` file generates a template to use for scan
  * Can be used with `-c` switch

***