Nmap学习8 - 端口扫描实验

最新推荐文章于 2024-09-10 19:04:12 发布

医生的托马斯

最新推荐文章于 2024-09-10 19:04:12 发布

阅读量4.6k

点赞数

分类专栏：安全文章标签： linux 网络安全

本文链接：https://blog.csdn.net/weixin_43838889/article/details/122880777

版权

安全专栏收录该内容

28 篇文章 9 订阅

订阅专栏

Nmap学习8 - 端口扫描实验

-sS (TCP SYN扫描)

nmap发送1000个常用服务端口的TCP SYN链接，端口顺序随机。

>nmap -sS --packet-trace 192.168.31.142
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-11 10:06 ?D1ú±ê×?ê±??
SENT (0.6030s) ARP who-has 192.168.31.142 tell 192.168.31.1
RCVD (0.6040s) ARP reply 192.168.31.142 is-at 00:0C:29:83:79:73
SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:22 S ttl=38 id=7617 iplen=44  seq=3403289209 win=1024 <mss 1460>
SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:135 S ttl=46 id=20457 iplen=44  seq=3403289209 win=1024 <mss 1460>
SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:53 S ttl=41 id=30293 iplen=44  seq=3403289209 win=1024 <mss 1460>
SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:5900 S ttl=45 id=16473 iplen=44  seq=3403289209 win=1024 <mss 1460>
SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:25 S ttl=37 id=4576 iplen=44  seq=3403289209 win=1024 <mss 1460>
SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:1025 S ttl=51 id=40887 iplen=44  seq=3403289209 win=1024 <mss 1460>
SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:113 S ttl=58 id=15451 iplen=44  seq=3403289209 win=1024 <mss 1460>
SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:995 S ttl=54 id=23730 iplen=44  seq=3403289209 win=1024 <mss 1460>
SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:23 S ttl=50 id=61533 iplen=44  seq=3403289209 win=1024 <mss 1460>
SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:110 S ttl=45 id=13415 iplen=44  seq=3403289209 win=1024 <mss 1460>
RCVD (0.6920s) TCP 192.168.31.142:22 > 192.168.31.1:47495 SA ttl=64 id=0 iplen=44  seq=2108754243 win=29200 <mss 1460>
RCVD (0.6920s) TCP 192.168.31.142:135 > 192.168.31.1:47495 RA ttl=64 id=56985 iplen=40  seq=0 win=0 
...
RCVD (0.7350s) TCP 192.168.31.142:1641 > 192.168.31.1:47495 RA ttl=64 id=57975 iplen=40  seq=0 win=0 
RCVD (0.7350s) TCP 192.168.31.142:1071 > 192.168.31.1:47495 RA ttl=64 id=57976 iplen=40  seq=0 win=0 
RCVD (0.7350s) TCP 192.168.31.142:2381 > 192.168.31.1:47495 RA ttl=64 id=57977 iplen=40  seq=0 win=0 
RCVD (0.7350s) TCP 192.168.31.142:8089 > 192.168.31.1:47495 RA ttl=64 id=57978 iplen=40  seq=0 win=0 
RCVD (0.7350s) TCP 192.168.31.142:1216 > 192.168.31.1:47495 RA ttl=64 id=57979 iplen=40  seq=0 win=0 
RCVD (0.7350s) TCP 192.168.31.142:8402 > 192.168.31.1:47495 RA ttl=64 id=57980 iplen=40  seq=0 win=0 
Nmap scan report for 192.168.31.142
Host is up (0.00088s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
3306/tcp open  mysql
MAC Address: 00:0C:29:83:79:73 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.74 seconds

TCP SYN扫描，常常被称为半开放扫描，因为它不打开一个完全的TCP连接。它发送一个SYN报文，就像您真的要打开一个连接，然后等待响应。

SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:22 S ttl=38 id=7617 iplen=44 seq=3403289209 win=1024 <mss 1460>
RCVD (0.6920s) TCP 192.168.31.142:22 > 192.168.31.1:47495 SA ttl=64 id=0 iplen=44 seq=2108754243 win=29200 <mss 1460>
SYN/ACK表示端口在监听 (开放)

SENT (0.6910s) TCP 192.168.31.1:47495 > 192.168.31.142:135 S ttl=46 id=20457 iplen=44 seq=3403289209 win=1024 <mss 1460>
RCVD (0.6920s) TCP 192.168.31.142:135 > 192.168.31.1:47495 RA ttl=64 id=56985 iplen=40 seq=0 win=0
RST (复位)表示没有监听者。

-p 指定端口

-p (只扫描指定的端口)
该选项指明您想扫描的端口，覆盖默认值。单个端口和用连字符表示的端口范围(如 1-1023)都可以。范围的开始以及/或者结束值可以被省略，分别导致Nmap使用1和65535。所以您可以指定 -p-从端口1扫描到65535。如果您特别指定，也可以扫描端口0。对于IP协议扫描(-sO)，该选项指定您希望扫描的协议号 (0-255)。

当既扫描TCP端口又扫描UDP端口时，您可以通过在端口号前加上T: 或者U:指定协议。协议限定符一直有效您直到指定另一个。例如，参数 -p U:53，111，137，T:21-25，80，139，8080 将扫描UDP 端口53，111，和137，同时扫描列出的TCP端口。注意，要既扫描 UDP又扫描TCP，您必须指定 -sU ，以及至少一个TCP扫描类型(如 -sS，-sF，或者 -sT)。如果没有给定协议限定符，端口号会被加到所有协议列表。

>nmap -sS -p123,22 --packet-trace 192.168.31.142
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-11 15:02 ?D1ú±ê×?ê±??
SENT (0.5990s) ARP who-has 192.168.31.142 tell 192.168.31.1
RCVD (0.5990s) ARP reply 192.168.31.142 is-at 00:0C:29:83:79:73
NSOCK INFO [0.6490s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK INFO [0.6490s] nsock_connect_udp(): UDP connection requested to 114.114.114.114:53 (IOD #1) EID 8
NSOCK INFO [0.6510s] nsock_read(): Read request from IOD #1 [114.114.114.114:53] (timeout: -1ms) EID 18
NSOCK INFO [0.6510s] nsock_iod_new2(): nsock_iod_new (IOD #2)
NSOCK INFO [0.6590s] nsock_connect_udp(): UDP connection requested to 198.18.0.1:53 (IOD #2) EID 24
NSOCK INFO [0.6600s] nsock_read(): Read request from IOD #2 [198.18.0.1:53] (timeout: -1ms) EID 34
NSOCK INFO [0.6600s] nsock_iod_new2(): nsock_iod_new (IOD #3)
NSOCK INFO [0.6630s] nsock_connect_udp(): UDP connection requested to 198.18.0.1:53 (IOD #3) EID 40
NSOCK INFO [0.6630s] nsock_read(): Read request from IOD #3 [198.18.0.1:53] (timeout: -1ms) EID 50
NSOCK INFO [0.6630s] nsock_iod_new2(): nsock_iod_new (IOD #4)
NSOCK INFO [0.6710s] nsock_connect_udp(): UDP connection requested to 198.18.0.1:53 (IOD #4) EID 56
NSOCK INFO [0.6710s] nsock_read(): Read request from IOD #4 [198.18.0.1:53] (timeout: -1ms) EID 66
NSOCK INFO [0.6710s] nsock_iod_new2(): nsock_iod_new (IOD #5)
NSOCK INFO [0.6730s] nsock_connect_udp(): UDP connection requested to 198.18.0.1:53 (IOD #5) EID 72
NSOCK INFO [0.6740s] nsock_read(): Read request from IOD #5 [198.18.0.1:53] (timeout: -1ms) EID 82
NSOCK INFO [0.6750s] nsock_write(): Write request for 45 bytes to IOD #1 EID 91 [114.114.114.114:53]
NSOCK INFO [0.6800s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [114.114.114.114:53]
NSOCK INFO [0.6800s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 91 [114.114.114.114:53]
NSOCK INFO [0.6800s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 24 [198.18.0.1:53]
NSOCK INFO [0.6800s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 40 [198.18.0.1:53]
NSOCK INFO [0.6800s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 56 [198.18.0.1:53]
NSOCK INFO [0.6800s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 72 [198.18.0.1:53]
NSOCK INFO [0.7030s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 18 [114.114.114.114:53] (122 bytes)
NSOCK INFO [0.7040s] nsock_read(): Read request from IOD #1 [114.114.114.114:53] (timeout: -1ms) EID 98
NSOCK INFO [0.7040s] nsock_iod_delete(): nsock_iod_delete (IOD #1)
NSOCK INFO [0.7040s] nevent_delete(): nevent_delete on event #98 (type READ)
NSOCK INFO [0.7040s] nsock_iod_delete(): nsock_iod_delete (IOD #2)
NSOCK INFO [0.7040s] nevent_delete(): nevent_delete on event #34 (type READ)
NSOCK INFO [0.7040s] nsock_iod_delete(): nsock_iod_delete (IOD #3)
NSOCK INFO [0.7040s] nevent_delete(): nevent_delete on event #50 (type READ)
NSOCK INFO [0.7040s] nsock_iod_delete(): nsock_iod_delete (IOD #4)
NSOCK INFO [0.7040s] nevent_delete(): nevent_delete on event #66 (type READ)
NSOCK INFO [0.7040s] nsock_iod_delete(): nsock_iod_delete (IOD #5)
NSOCK INFO [0.7040s] nevent_delete(): nevent_delete on event #82 (type READ)
SENT (0.7380s) TCP 192.168.31.1:39632 > 192.168.31.142:22 S ttl=53 id=57179 iplen=44  seq=1555126439 win=1024 <mss 1460>
SENT (0.7420s) TCP 192.168.31.1:39632 > 192.168.31.142:123 S ttl=45 id=55924 iplen=44  seq=1555126439 win=1024 <mss 1460>
RCVD (0.7490s) TCP 192.168.31.142:22 > 192.168.31.1:39632 SA ttl=64 id=0 iplen=44  seq=2517647007 win=29200 <mss 1460>
RCVD (0.7490s) TCP 192.168.31.142:123 > 192.168.31.1:39632 RA ttl=64 id=27332 iplen=40  seq=0 win=0
Nmap scan report for 192.168.31.142
Host is up (0.0021s latency).

PORT    STATE  SERVICE
22/tcp  open   ssh
123/tcp closed ntp
MAC Address: 00:0C:29:83:79:73 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.75 seconds

用逗号分隔的端口列表：$ nmap -p80,443 localhost
用连字符表示的端口范围：$ nmap -p1-100 localhost
从 1 到 65535 的所有端口的别名：# nmap -p- localhost
特定端口（按协议）：# nmap -pT:25,U:53
服务名称：# nmap -p smtp
带有通配符的服务名称：# nmap -p smtp*
仅在 Nmap 服务数据库中注册的端口：# nmap -p[1-65535] <目标>

-sT (TCP connect()扫描)

Connect()扫描就是默认的TCP 正常连接。

>nmap -sT -p20-22 --packet-trace 192.168.31.142
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-11 15:18 ?D1ú±ê×?ê±??
SENT (0.6110s) ARP who-has 192.168.31.142 tell 192.168.31.1
RCVD (0.6120s) ARP reply 192.168.31.142 is-at 00:0C:29:83:79:73
Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 1 undergoing ARP Ping Scan
ARP Ping Scan Timing: About 100.00% done; ETC: 15:18 (0:00:00 remaining)
NSOCK INFO [0.6760s] nsock_iod_new2(): nsock_iod_new (IOD #1)
...
NSOCK INFO [0.7130s] nevent_delete(): nevent_delete on event #66 (type READ)
NSOCK INFO [0.7130s] nsock_iod_delete(): nsock_iod_delete (IOD #5)
NSOCK INFO [0.7130s] nevent_delete(): nevent_delete on event #82 (type READ)
CONN (0.7280s) TCP localhost > 192.168.31.142:22 => Operation now in progress
CONN (0.7360s) TCP localhost > 192.168.31.142:21 => Operation now in progress
CONN (0.7370s) TCP localhost > 192.168.31.142:20 => Operation now in progress
CONN (0.7370s) TCP localhost > 192.168.31.142:22 => Connected
CONN (1.8650s) TCP localhost > 192.168.31.142:20 => Operation now in progress
CONN (1.8660s) TCP localhost > 192.168.31.142:21 => Operation now in progress
Nmap scan report for 192.168.31.142
Host is up (0.0020s latency).

PORT   STATE    SERVICE
20/tcp filtered ftp-data
21/tcp filtered ftp
22/tcp open     ssh
MAC Address: 00:0C:29:83:79:73 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 2.00 seconds

CONN (0.7280s) TCP localhost > 192.168.31.142:22 => Operation now in progress
CONN (0.7370s) TCP localhost > 192.168.31.142:22 => Connected
nmap使用Connect() API获得每个连接尝试的状态信息，而不是读取响应的原始报文。

-sU (UDP扫描)

UDP扫描发送空的(没有数据)UDP报头到每个目标端口。

>nmap -sU -p67,68,111 --packet-trace 192.168.31.142
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-11 15:43 ?D1ú±ê×?ê±??
SENT (0.6790s) ARP who-has 192.168.31.142 tell 192.168.31.1
RCVD (0.6800s) ARP reply 192.168.31.142 is-at 00:0C:29:83:79:73
NSOCK INFO [0.7390s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK INFO [0.7390s] nsock_connect_udp(): UDP connection requested to 114.114.114.114:53 (IOD #1) EID 8
NSOCK INFO [0.7400s] nsock_read(): Read request from IOD #1 [114.114.114.114:53] (timeout: -1ms) EID 18
...
NSOCK INFO [0.7570s] nsock_iod_delete(): nsock_iod_delete (IOD #5)
NSOCK INFO [0.7570s] nevent_delete(): nevent_delete on event #82 (type READ)
SENT (0.7580s) UDP 192.168.31.1:44771 > 192.168.31.142:111 ttl=59 id=5483 iplen=68
SENT (0.7580s) UDP 192.168.31.1:44771 > 192.168.31.142:67 ttl=40 id=759 iplen=272
SENT (0.7590s) UDP 192.168.31.1:44771 > 192.168.31.142:68 ttl=39 id=16088 iplen=28
RCVD (0.7590s) ICMP [192.168.31.142 > 192.168.31.1 Port 67 unreachable (type=3/code=3) ] IP [ttl=64 id=37532 iplen=300 ]
RCVD (0.7590s) UDP 192.168.31.142:111 > 192.168.31.1:44771 ttl=64 id=17983 iplen=60
SENT (1.8740s) UDP 192.168.31.1:44772 > 192.168.31.142:68 ttl=51 id=4076 iplen=28
Nmap scan report for 192.168.31.142
Host is up (0.0010s latency).

PORT    STATE         SERVICE
67/udp  closed        dhcps
68/udp  open|filtered dhcpc
111/udp open          rpcbind
MAC Address: 00:0C:29:83:79:73 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 2.01 seconds

SENT (0.7580s) UDP 192.168.31.1:44771 > 192.168.31.142:67 ttl=40 id=759 iplen=272
RCVD (0.7590s) ICMP [192.168.31.142 > 192.168.31.1 Port 67 unreachable (type=3/code=3) ] IP [ttl=64 id=37532 iplen=300 ]
如果返回ICMP端口不可到达错误(类型3，代码3)，该端口是closed(关闭的)。

-sN; -sF; -sX (TCP Null，FIN，and Xmas扫描)

-sN TCP Null扫描

不设置任何标志位(tcp标志头是0)

>nmap -sN -p20-23 --packet-trace 192.168.31.142
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-11 15:56 ?D1ú±ê×?ê±??
SENT (0.6400s) ARP who-has 192.168.31.142 tell 192.168.31.1
RCVD (0.6400s) ARP reply 192.168.31.142 is-at 00:0C:29:83:79:73
NSOCK INFO [0.6890s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK INFO [0.6900s] nsock_connect_udp(): UDP connection requested to 114.114.114.114:53 (IOD #1) EID 8
NSOCK INFO [0.6910s] nsock_read(): Read request from IOD #1 [114.114.114.114:53] (timeout: -1ms) EID 18
...
NSOCK INFO [0.7090s] nsock_iod_delete(): nsock_iod_delete (IOD #5)
NSOCK INFO [0.7090s] nevent_delete(): nevent_delete on event #82 (type READ)
SENT (0.7110s) TCP 192.168.31.1:33617 > 192.168.31.142:22  ttl=48 id=64863 iplen=40  seq=1571317302 win=1024
SENT (0.7110s) TCP 192.168.31.1:33617 > 192.168.31.142:23  ttl=43 id=15345 iplen=40  seq=1571317302 win=1024
SENT (0.7110s) TCP 192.168.31.1:33617 > 192.168.31.142:21  ttl=50 id=24600 iplen=40  seq=1571317302 win=1024
SENT (0.7110s) TCP 192.168.31.1:33617 > 192.168.31.142:20  ttl=40 id=33994 iplen=40  seq=1571317302 win=1024
RCVD (0.7110s) TCP 192.168.31.142:23 > 192.168.31.1:33617 RA ttl=64 id=34146 iplen=40  seq=0 win=0
RCVD (0.7120s) TCP 192.168.31.142:21 > 192.168.31.1:33617 RA ttl=64 id=34147 iplen=40  seq=0 win=0
RCVD (0.7120s) TCP 192.168.31.142:20 > 192.168.31.1:33617 RA ttl=64 id=34148 iplen=40  seq=0 win=0
SENT (1.8200s) TCP 192.168.31.1:33618 > 192.168.31.142:22  ttl=42 id=31705 iplen=40  seq=1571382839 win=1024
Nmap scan report for 192.168.31.142
Host is up (0.00023s latency).

PORT   STATE         SERVICE
20/tcp closed        ftp-data
21/tcp closed        ftp
22/tcp open|filtered ssh
23/tcp closed        telnet
MAC Address: 00:0C:29:83:79:73 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.95 seconds

RCVD (0.7110s) TCP 192.168.31.142:23 > 192.168.31.1:33617 RA ttl=64 id=34146 iplen=40 seq=0 win=0
RCVD (0.7120s) TCP 192.168.31.142:21 > 192.168.31.1:33617 RA ttl=64 id=34147 iplen=40 seq=0 win=0
RCVD (0.7120s) TCP 192.168.31.142:20 > 192.168.31.1:33617 RA ttl=64 id=34148 iplen=40 seq=0 win=0
20/21/23端口返回RST (复位)表示没有监听者。

SENT (0.7110s) TCP 192.168.31.1:33617 > 192.168.31.142:22 ttl=48 id=64863 iplen=40 seq=1571317302 win=1024
SENT (1.8200s) TCP 192.168.31.1:33618 > 192.168.31.142:22 ttl=42 id=31705 iplen=40 seq=1571382839 win=1024
nmap发送两次22端口扫描，服务端没有返回。没有响应也可能意味着报文过滤器丢弃了探测报文或者它引发的任何响应。因此Nmap无法确定该端口是开放的还是被过滤的。 UDP，IP协议， FIN，Null，和Xmas扫描可能把端口归入“open|filtered” 。

-sF; -sX (FIN，and Xmas扫描) 从–packet-trace 结果看，与-sN相同。

-sA (TCP ACK扫描)

这种扫描与目前为止讨论的其它扫描的不同之处在于它不能确定open(开放的)或者 open|filtered(开放或者过滤的))端口。它用于发现防火墙规则，确定它们是有状态的还是无状态的，哪些端口是被过滤的。

服务端 192.168.31.142 执行，将22端口数据丢弃。

iptables -A INPUT -p tcp --dport 22 -j DROP

>nmap -sA -p20-23 --packet-trace 192.168.31.142
Starting Nmap 7.91 ( https://nmap.org ) at 2022-02-11 16:19 ?D1ú±ê×?ê±??
SENT (0.6350s) ARP who-has 192.168.31.142 tell 192.168.31.1
RCVD (0.6350s) ARP reply 192.168.31.142 is-at 00:0C:29:83:79:73
NSOCK INFO [0.6840s] nsock_iod_new2(): nsock_iod_new (IOD #1)
...
NSOCK INFO [0.7010s] nsock_iod_delete(): nsock_iod_delete (IOD #5)
NSOCK INFO [0.7010s] nevent_delete(): nevent_delete on event #82 (type READ)
SENT (0.7030s) TCP 192.168.31.1:49417 > 192.168.31.142:22 A ttl=55 id=47881 iplen=40  seq=0 win=1024
SENT (0.7030s) TCP 192.168.31.1:49417 > 192.168.31.142:23 A ttl=54 id=15580 iplen=40  seq=0 win=1024
SENT (0.7030s) TCP 192.168.31.1:49417 > 192.168.31.142:21 A ttl=58 id=18026 iplen=40  seq=0 win=1024
SENT (0.7030s) TCP 192.168.31.1:49417 > 192.168.31.142:20 A ttl=50 id=59861 iplen=40  seq=0 win=1024
RCVD (0.7030s) TCP 192.168.31.142:23 > 192.168.31.1:49417 R ttl=64 id=46495 iplen=40  seq=476804170 win=0
RCVD (0.7030s) TCP 192.168.31.142:21 > 192.168.31.1:49417 R ttl=64 id=46496 iplen=40  seq=476804170 win=0
RCVD (0.7030s) TCP 192.168.31.142:20 > 192.168.31.1:49417 R ttl=64 id=46497 iplen=40  seq=476804170 win=0
SENT (1.8170s) TCP 192.168.31.1:49418 > 192.168.31.142:22 A ttl=37 id=52126 iplen=40  seq=0 win=1024
Nmap scan report for 192.168.31.142
Host is up (0.00s latency).

PORT   STATE      SERVICE
20/tcp unfiltered ftp-data
21/tcp unfiltered ftp
22/tcp filtered   ssh
23/tcp unfiltered telnet
MAC Address: 00:0C:29:83:79:73 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.94 seconds

SENT (0.7030s) TCP 192.168.31.1:49417 > 192.168.31.142:23 A ttl=54 id=15580 iplen=40 seq=0 win=1024
SENT (0.7030s) TCP 192.168.31.1:49417 > 192.168.31.142:21 A ttl=58 id=18026 iplen=40 seq=0 win=1024
SENT (0.7030s) TCP 192.168.31.1:49417 > 192.168.31.142:20 A ttl=50 id=59861 iplen=40 seq=0 win=1024
RCVD (0.7030s) TCP 192.168.31.142:23 > 192.168.31.1:49417 R ttl=64 id=46495 iplen=40 seq=476804170 win=0
RCVD (0.7030s) TCP 192.168.31.142:21 > 192.168.31.1:49417 R ttl=64 id=46496 iplen=40 seq=476804170 win=0
RCVD (0.7030s) TCP 192.168.31.142:20 > 192.168.31.1:49417 R ttl=64 id=46497 iplen=40 seq=476804170 win=0
当扫描未被过滤的系统时， open(开放的)和closed(关闭的) 端口都会返回RST报文。Nmap把它们标记为 unfiltered(未被过滤的)，意思是 ACK报文不能到达，但至于它们是open(开放的)或者 closed(关闭的) 无法确定。

SENT (0.7030s) TCP 192.168.31.1:49417 > 192.168.31.142:22 A ttl=55 id=47881 iplen=40 seq=0 win=1024
SENT (1.8170s) TCP 192.168.31.1:49418 > 192.168.31.142:22 A ttl=37 id=52126 iplen=40 seq=0 win=1024
不响应的端口或者发送特定的ICMP错误消息(类型3，代号1，2，3，9，10，或者13)的端口，标记为 filtered(被过滤的)。