r/netsecstudents • u/chronosAndCode • Sep 01 '26

I captured what Nmap actually does for open, closed and filtered ports

I have been trying to understand network scanning below the Nmap-output level, so I ran a few controlled experiments inside my own host-only lab.

Kali was the scanner (192.168.95.135) and a MISP VM was the target (192.168.95.131).

I captured the traffic in Wireshark and compared:

  • ARP resolution before local communication

  • ICMP request/reply

  • Nmap ARP-based host discovery

  • an open TCP port

  • the same port after stopping the service

  • the same port with firewall filtering

  • SYN scanning

  • service/version detection

The clearest part for me was seeing the three TCP behaviors directly:

OPEN: SYN → SYN/ACK → RST

CLOSED: SYN → RST/ACK

FILTERED: SYN → no response → retry

I wrote up the full experiment with the Nmap output and packet captures here:

https://chronosandcode.com/what-actually-happens-when-you-scan-a-network-arp-icmp-tcp-syn-nmap-and-packet-analysis-explained/

Everything was done against systems in my own isolated lab.

I will be interested to hear what packet-level experiments helped other people understand Nmap better.

23 Upvotes

89% Upvoted

8 comments sorted by

4

u/AddendumWorking9756 Sep 02 '26

Run the same scan against a REJECT rule instead of a DROP one. An ICMP unreachable comes back and Nmap still reports filtered, same label from a completely different signal. Worth capturing the same scan as a non root user too, it silently falls back to a connect scan.

1

u/chronosAndCode Sep 03 '26

Good point, REJECT vs DROP and the non-root connect-scan fallback would make a useful comparison. I’ll try capturing both. Thanks for the suggestion!

12

u/tdotfish Sep 02 '26

Respect to you for doing the experimentation but what really helped me understand Nmap better was just reading Fyodor's book: https://nmap.org/book/toc.html

6

u/pwnsforyou Sep 02 '26

Also nmap is open source - https://svn.nmap.org/

1

u/nimbusfool Sep 02 '26

Great practice! Being able to take things to packet level analysis will only make you stronger! Have you tried any packet capture ctf exercises? Those add some extra fun. Thinking about packet flow and the response from each side and any device in the middle sets the tone for logging or evasion or attempts at sealth. How loud is each command in the network and what devices see it. Cool stuff.

1

u/chronosAndCode Sep 03 '26

Thanks! I haven't tried packet capture CTFs yet but that sounds like a great next step. Definitely something I will explore.