PAM Port Scan Status meaning (firewall - open, filtered, closed)
Article ID: 130082
Updated On:
Products
CA Privileged Access Manager - Cloakware Password Authority (PA)
CA Privileged Access Manager (PAM)
Issue/Introduction
In "PAM - Configuration - Tools - Networking Tools - Port Scan" you can scan a specific IP and Port to see if the port is open (source being the PAM and destination being the IP entered).
There are several "Status" values and what are they?
Environment
Release:
Component: CAPAMX
Component: CAPAMX
Resolution
PAM is not directly checking the destination IP and Port.
In fact, it is executing nmap command locally to check the requested IP and Port and displaying the result.
In the following example, you are trying to see if the destination(172.17.8.1) and port (TCP 80) is open or not.
Port Scan Result shows the port is open.
This is equivalent to running the nmap command below.
nmap -p 80 172.17.8.1
There are several status such as "open", "filtered" and "closed".
What does these status mean?
The status is a result from nmap trying tcp handshake against the destination IP and TCP Port.
OPEN: nmap sent SYN. Destination returned ACK. (It would actually be "SYN/ACK" but I am just trying to explain that destination responded)
CLOSED: nmap sent SYN. Destination reutrned RST.
FILTERED: nmap sent SYN. Destination did not return anything or received icmp error.
OPEN and CLOSE is clear.
CLOSED means the destination, either the OS or whoever is responding, is reporting that there is no service running/listening on this port.
This is equivalent to running the nmap command below.
nmap -p 8443 172.17.8.1
FILTERED can be due to several reasons such as the firewall dropping the request with no response or the destination was not reachable.
Sample below shows filtered status due to firewall.
This is equivalent to running the nmap command below.
nmap -p 80 172.17.8.1
Following sample shows filtered status due to destination not being reachable.
This is equivalent to running the nmap command below.
nmap -p 80 192.168.0.1
It can also be due to firewall that is only allowing one way traffic.
Regardless of what the reason is, if the STATE is not "OPEN" then customer will need to work with their network team to find out why.
In fact, it is executing nmap command locally to check the requested IP and Port and displaying the result.
In the following example, you are trying to see if the destination(172.17.8.1) and port (TCP 80) is open or not.
Port Scan Result shows the port is open.
<Please see attached file for image>
This is equivalent to running the nmap command below.
nmap -p 80 172.17.8.1
<Please see attached file for image>
There are several status such as "open", "filtered" and "closed".
What does these status mean?
The status is a result from nmap trying tcp handshake against the destination IP and TCP Port.
OPEN: nmap sent SYN. Destination returned ACK. (It would actually be "SYN/ACK" but I am just trying to explain that destination responded)
CLOSED: nmap sent SYN. Destination reutrned RST.
FILTERED: nmap sent SYN. Destination did not return anything or received icmp error.
OPEN and CLOSE is clear.
CLOSED means the destination, either the OS or whoever is responding, is reporting that there is no service running/listening on this port.
<Please see attached file for image>
This is equivalent to running the nmap command below.
nmap -p 8443 172.17.8.1
<Please see attached file for image>
FILTERED can be due to several reasons such as the firewall dropping the request with no response or the destination was not reachable.
Sample below shows filtered status due to firewall.
<Please see attached file for image>
This is equivalent to running the nmap command below.
nmap -p 80 172.17.8.1
<Please see attached file for image>
Following sample shows filtered status due to destination not being reachable.
<Please see attached file for image>
This is equivalent to running the nmap command below.
nmap -p 80 192.168.0.1
<Please see attached file for image>
It can also be due to firewall that is only allowing one way traffic.
Regardless of what the reason is, if the STATE is not "OPEN" then customer will need to work with their network team to find out why.
Attachments
Feedback
Yes
No
Powered by
