Smarter by Design.Simpler for Business
sys-cmd nmap
sys-cmd nmap scans the ports of a remote target from the route table selected in WEB-CLI and reports the result open, closed or filtered for each port. It is used to see whether the service port of a backend can really be reached from the network on which TR7 is located and, if it cannot, to distinguish whether the problem is a wrong port or an obstacle on the way.
Command Summary
# type nmap and press Tab: a free parameter
admin@TR7LBWAF01> sys-cmd nmap
<nmap-parameter-1>
admin@TR7LBWAF01> sys-cmd nmap <parameters> <target>
admin@TR7LBWAF01>
Everything written after the word nmap is passed to the tool as it is. There is no mandatory field; the target address, name or subnet is written together with the parameters according to the tool's own syntax.
How It Works
| Subject | Behavior |
|---|---|
| Context | The scan is made from within the selected v-device and route table; the result is the state seen from that route table. |
| Duration | It closes by itself when the scan finishes. As the number of ports and the number of targets increase, the duration gets longer. |
| Stopping | Ctrl+C stops the scan. |
| Pipe | The output can be filtered with | or written to a file with to-file. |
| Recording | Every run is written to the user logs. |
Frequently Used Parameters
| Parameter | What it does | What is written after it |
|---|---|---|
-p | Determines the ports to be scanned | A port list or range (e.g. 80,443 · 8000-8100) |
-Pn | Does not first test with ICMP whether the target is up; it is required on targets that block ICMP | — |
-sn | Finds only the addresses that respond, without scanning ports | — |
-sV | Tries to detect the name and the version of the service on the open ports | — |
-sU | Scans the UDP ports | — |
-n | Does not resolve the addresses to names | — |
--open | Lists only the open ports | — |
The table summarizes frequently used parameters; the full list and behavior depend on the version of the tool on the device.
What the Results Mean
| Result | Meaning | Possible cause |
|---|---|---|
open | The port was reached and a service responded | — |
closed | The port was reached but there is no listening service | The service is down or the port is wrong |
filtered | No response came to the probe packet | A firewall on the way or on the target is dropping the packet |
Examples
admin@TR7LBWAF01> sys-cmd nmap -Pn -p 443,8080,8443 10.20.0.30
admin@TR7LBWAF01>
admin@TR7LBWAF01> sys-cmd nmap -Pn -sV -p 443 10.20.0.30
admin@TR7LBWAF01>
admin@TR7LBWAF01> sys-cmd nmap -sn 10.20.0.0/24
admin@TR7LBWAF01>
admin@TR7LBWAF01> sys-cmd nmap -Pn -sU -p 53 10.0.7.53
admin@TR7LBWAF01>
Things to Know
A scan leaves a trace on a production network
Wide port ranges and subnet scans can create load on the target servers and can trigger intrusion detection systems. Only the target and the port that need to be reached are scanned; if the organization's policy makes scanning subject to approval, approval is obtained first.
- UDP scanning is slow. The
-sUresults take a long time and mostly returnopen|filtered; it is used with a narrow port list. - The difference between
filteredandclosedshows where the problem is:closedpoints to the target itself, andfilteredto an obstacle in between. - To connect manually to a single port and see the first response of the service,
telnetis used, and for the HTTP responsecurl.
