nmap behaviour about ssh discovering

[PowerGod]

I'm curious about something that never happened before while using nmap, I like the results, but I wonder if it's really the right behaviour...

I have a Debian stable setup, where I installed an ssh server in the simple way, downloaded from the repo, started the daemon and changed in the conf file the port with one >1024, then I port-forwarded the router to this pc.

I went to work and tried an ssh connection, worked without problems.

Then, just for curiosity, because I'm not a security expert and never played too much with a linux server, I tried to run nmap to have a look at all the services and open ports.

The first simple scan (ports/services/OS version) resulted in a "There is no computer at the address"...

So I forced the search with "-Pn" to skip hosts discovery, and it actually wasn't able to determine the OS, and told that all ports were closed...

Then I tried to force the portscan from 1 to 65535 and after a while I seen as open just the port I use for bittorrent, and another one without services that sometimes I use for network games...

why it wasn't able to discover the ssh port ?

 

[levi]

Good question. Have you tried running nmap from inside your local network to see what it looks like there before going through the router?

I've just tried it on my server, and I also need to pass -PN to get it to bypass the ping test. It's unable to determine my OS version, but it seems to be able to see and talk to the SSH port.

From outside it may be a little harder to tell. Most scans will fail because the router will return nothing for all ports except the one you're forwarding, but I'm not sure why that's different to my server here where nmap can only find the ssh port to talk to. I've not reconfigured my ssh port, because it shouldn't be open to anyone not on the network, and you'd need my private key to log on anyway, but that shouldn't make a difference I'd have thought.

 

[PowerGod]

In the local network nmap can find all the ports, even the ssh...

and it's also able to show the version of the service

 

[Linux-SWAT]

Some NAT magic.

 

[levi]

Possibly, but port forwarding should allow an incoming connection which doesn't invole NAT.


I'm not actually sure, at the ethernet level, what happens when it confirms a port is active. There's clearly nothing as advanced as a ping response, as that's a whole new packet that gets sent in response.


Edit: I know that if you set up a connection, a negotiation occurs such that the machines actually talk to ports in the 65000s, leaving the original port free for further connections. That incoming 65000 connection will be registered in the NAT table, which is how the ssh connection works from outside, but I'm not sure how what nmap does differs from that process of making a NATted connection.

 

[PowerGod]

I'll try to have a look at what ports are used while I'm connected from the outside