What is filtered port

Add a comment. Active Oldest Votes. This is what the nmap docs say about the filtered state filtered Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. In your case the command might look something like: traceroute Improve this answer.

Community Bot 1. There are no active software firewalls on those two machines, nmap -p localhost shows the ports opened, and the dedicate firewall is reportedly opened. The evidence you have suggests that something is filtering we can't know what that is as we don't know your config.

Host based firewalls often allow all traffic on the loopback localhost interface so that's a possibly misleading test. Is there any chance that you use linux with iptables "-j DROP"?

What nmap documentation refers as filtered is actually a dropped packet on any protocol. Is this software actually bound to an external IP? If it's all bound to Check netstat — devicenull. Nmap provides several ways to get more information about what is causing the filtering: The --reason option will show the type of response that caused the "filtered" port state. This could be "no-response" or "admin-prohibited" or something else.

If the TTL for a filtered port is different from usually greater than the TTL for open ports, then the difference between the TTLs is the network distance between the target and the filtering device. The --traceroute function will show information about hops along your route, any of which could be filtering your traffic.

In some cases, the reverse DNS name for one of the hops will even be something like "firewall1. This is something like a combination of the previous two techniques, and usually works quite well. Short answer - No, there is no way that you can see it.

If you are in the same subnet as target host almost for sure firewall is on target machine. Maciek Sawicki Maciek Sawicki 1 1 gold badge 8 8 silver badges 21 21 bronze badges. Update: I meant tcptraceroute, I have it aliased. Makdaam Makdaam 21 3 3 bronze badges. Sign up or log in Sign up using Google. Sign up using Facebook.

Sign up using Email and Password. Post as a guest Name. Email Required, but never shown. The Overflow Blog. Podcast The first ten years of our programming lives. Featured on Meta. Now live: A fully responsive profile. Related 2. Because closed ports are reachable, it may be worth scanning later in case some open up.

Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next. Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port.

The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. These ports frustrate attackers because they provide so little information.

Sometimes they respond with ICMP error messages such as type 3 code 13 destination unreachable: communication administratively prohibited , but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering.

This slows down the scan dramatically. The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Nmap places ports in this state when it is unable to determine whether a port is open or filtered.

This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered.