Arch Linux

marko154

Member

Registered: 2013-08-13

Posts: 14

nmap scan listing random open ports

Hello,

If I issue the following command several times in a row:

nmap -n -r -v -p1-65535 -sT 127.0.0.1

On each run, this command would list the usual open ports (ssh etc., same as netstat), but sometimes there would be 1-3 random open ports somewhere in range 10000..60000, every run different ones. Checking listening ports with netstat never shows any such open ports. Random open ports vanish if I use nmap with -sV or -sS instead of -sT option. I can also replace localhost with LAN address and still get the same results. Could these be false-positives?

I can reproduce this on another Arch box, but not on Ubuntu. Can ask you to try if you are getting similar results, or should I start to worry about a rootkit? Thanks.

Cheers,
Marko

marko154

Member

Registered: 2013-08-13

Posts: 14

Re: nmap scan listing random open ports

Seem to be false-positives, see:

http://seclists.org/incidents/2002/Dec/136