I'm currently studying a peneteration/hacking course. I am trying to use nmap against a target to find all the ports that are filtered.

I thought if I used an ACK-scan nmap would give me all the filtered ports. I used
nmap -sA -p- target
and the result was All the 65535 ports scanned are unfiltered. Is this even reasonable? What other scans can I use to complement my first scan?

Dani AI

Generated

Short add-on for (and thanks to ): getting "all ports unfiltered" from an ACK probe is plausible. ACK scans only tell you whether a firewall/middlebox is filtering packets — they do not identify which ports are open. If the target or an intervening device returns RST to your ACKs, Nmap will report those ports as unfiltered. See Nmap's scan-type overview for details: Nmap scan techniques.

Useful complementary scans and why they help:

  • nmap -sS target — SYN scan: distinguishes open (SYN/ACK) from closed (RST) and filtered (no response).
  • nmap -sT target — TCP connect: works when raw sockets are unavailable.
  • nmap -sF, -sN, -sX — FIN/NULL/Xmas: can reveal stateless filtering differences.
  • nmap -sU target — UDP scan: checks UDP services (slower; often ambiguous).
  • -sV and -O — service and OS detection for more context.
  • -sI (idle scan) — advanced, stealthy check that can expose filtering between you and target.

Quick troubleshooting checklist:

  • Confirm you really are scanning the intended host (not localhost, NATed IP, or lab VM).
  • Run a packet capture (if you have permission) to see whether probes or responses are dropped.
  • Try a scan from a different network to detect source-based filtering.
  • Use Nmap verbosity and --reason to see why Nmap classifies a port that way.

Always scan only systems you are authorized to test.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.