これは何?
ポートスキャナであるNmapを使用してSYN(ステルス)スキャンでfilterd判定になっているポートに対して、TCPコネクトスキャンを使うとopenになるケースに遭遇したので防備録。
脆弱性診断などで空いているはずのportがfilterdになってしまう時にコネクトスキャンを使うとopen判定が得られるかもしれない。
背景
- NmapのSYN(ステルス)スキャンを使ってポートスキャンを実施し，22番ポートが
filterdになっていることを確認 - 試しにsshで通常接続をすると接続できる
- PowershellのTest-Connectionを使うとopen判定
port scan方法の違い
概要レベルなのでポートのopen，closeには実際には詳細な判定アルゴリズムがあるかも。
SYNスキャン
nmapの-sSオプションで指定するスキャン方法。
SYNパケットを作成するためにroot権限でnmapを実行することが必要
コネクトスキャン
nmapの-sTオプションで指定する。
SYNスキャンと異なり，OSのソケット等を使ってパケットを送信するため，
SYNパケットをnmap側で作る必要がないことから一般ユーザでも実行できる。
なぜSYNスキャンだけがfilterd判定されてしまったのか
SYNパケットに対してターゲットホストからSYN-ACKが返されるのは両スキャン共通である。
つまり，SYNパケットの構造を見て，ファイヤーウォールなどがportスキャンだと検知している?と考えられる。
そこでWiresharkを使い，両スキャンで実際に飛んでいるSYNパケットを見てみた
SYNスキャンのSYNパケット
■SYNスキャンのSYNパケットのサマリ
101 23:01:26.092031496 localhost localhost TCP 38268 → 22 [SYN] Seq=0 Win=1024 Len=0 MSS=1460
SYNスキャンのSYNパケット全部
Frame 101: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) on interface lo, id 0
Interface id: 0 (lo)
Interface name: lo
Encapsulation type: Ethernet (1)
Arrival Time: May 9, 2025 23:01:26.092031496 JST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1746799286.092031496 seconds
[Time delta from previous captured frame: 1.054054651 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 16.417886480 seconds]
Frame Number: 101
Frame Length: 58 bytes (464 bits)
Capture Length: 58 bytes (464 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)
Address: 00:00:00_00:00:00 (00:00:00:00:00:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: 00:00:00_00:00:00 (00:00:00:00:00:00)
Address: 00:00:00_00:00:00 (00:00:00:00:00:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: localhost (127.0.0.1), Dst: localhost (127.0.0.1)
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 44
Identification: 0xd0a7 (53415)
Flags: 0x00
0... .... = Reserved bit: Not set
.0.. .... = Don't fragment: Not set
..0. .... = More fragments: Not set
...0 0000 0000 0000 = Fragment Offset: 0
Time to Live: 41
Protocol: TCP (6)
Header Checksum: 0xc322 [validation disabled]
[Header checksum status: Unverified]
Source Address: localhost (127.0.0.1)
Destination Address: localhost (127.0.0.1)
Transmission Control Protocol, Src Port: 38268, Dst Port: 22, Seq: 0, Len: 0
Source Port: 38268
Destination Port: 22
[Stream index: 2]
[Conversation completeness: Incomplete (35)]
[TCP Segment Len: 0]
Sequence Number: 0 (relative sequence number)
Sequence Number (raw): 817639011
[Next Sequence Number: 1 (relative sequence number)]
Acknowledgment Number: 0
Acknowledgment number (raw): 0
0110 .... = Header Length: 24 bytes (6)
Flags: 0x002 (SYN)
000. .... .... = Reserved: Not set
...0 .... .... = Nonce: Not set
.... 0... .... = Congestion Window Reduced (CWR): Not set
.... .0.. .... = ECN-Echo: Not set
.... ..0. .... = Urgent: Not set
.... ...0 .... = Acknowledgment: Not set
.... .... 0... = Push: Not set
.... .... .0.. = Reset: Not set
.... .... ..1. = Syn: Set
[Expert Info (Chat/Sequence): Connection establish request (SYN): server port 22]
[Connection establish request (SYN): server port 22]
[Severity level: Chat]
[Group: Sequence]
.... .... ...0 = Fin: Not set
[TCP Flags: ··········S·]
Window: 1024
[Calculated window size: 1024]
Checksum: 0xa172 [unverified]
[Checksum Status: Unverified]
Urgent Pointer: 0
Options: (4 bytes), Maximum segment size
TCP Option - Maximum segment size: 1460 bytes
Kind: Maximum Segment Size (2)
Length: 4
MSS Value: 1460
[Timestamps]
[Time since first frame in this TCP stream: 0.000000000 seconds]
[Time since previous frame in this TCP stream: 0.000000000 seconds]
コネクトスキャンのSYNパケット
■コネクトスキャンのSYNパケットのサマリ
116 23:01:31.039355471 localhost localhost TCP 35246 → 22 [SYN] Seq=0 Win=65495 Len=0 MSS=65495 SACK_PERM=1 TSval=696235419 TSecr=0 WS=1024
コネクトスキャンのSYNパケット全部
Frame 116: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface lo, id 0
Interface id: 0 (lo)
Interface name: lo
Encapsulation type: Ethernet (1)
Arrival Time: May 9, 2025 23:01:31.039355471 JST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1746799291.039355471 seconds
[Time delta from previous captured frame: 0.135641772 seconds]
[Time delta from previous displayed frame: 4.947283336 seconds]
[Time since reference or first frame: 21.365210455 seconds]
Frame Number: 116
Frame Length: 74 bytes (592 bits)
Capture Length: 74 bytes (592 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)
Address: 00:00:00_00:00:00 (00:00:00:00:00:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: 00:00:00_00:00:00 (00:00:00:00:00:00)
Address: 00:00:00_00:00:00 (00:00:00:00:00:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: localhost (127.0.0.1), Dst: localhost (127.0.0.1)
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 60
Identification: 0x5692 (22162)
Flags: 0x40, Don't fragment
0... .... = Reserved bit: Not set
.1.. .... = Don't fragment: Set
..0. .... = More fragments: Not set
...0 0000 0000 0000 = Fragment Offset: 0
Time to Live: 64
Protocol: TCP (6)
Header Checksum: 0xe627 [validation disabled]
[Header checksum status: Unverified]
Source Address: localhost (127.0.0.1)
Destination Address: localhost (127.0.0.1)
Transmission Control Protocol, Src Port: 35246, Dst Port: 22, Seq: 0, Len: 0
Source Port: 35246
Destination Port: 22
[Stream index: 3]
[Conversation completeness: Complete, NO_DATA (39)]
[TCP Segment Len: 0]
Sequence Number: 0 (relative sequence number)
Sequence Number (raw): 3977393822
[Next Sequence Number: 1 (relative sequence number)]
Acknowledgment Number: 0
Acknowledgment number (raw): 0
1010 .... = Header Length: 40 bytes (10)
Flags: 0x002 (SYN)
000. .... .... = Reserved: Not set
...0 .... .... = Nonce: Not set
.... 0... .... = Congestion Window Reduced (CWR): Not set
.... .0.. .... = ECN-Echo: Not set
.... ..0. .... = Urgent: Not set
.... ...0 .... = Acknowledgment: Not set
.... .... 0... = Push: Not set
.... .... .0.. = Reset: Not set
.... .... ..1. = Syn: Set
[Expert Info (Chat/Sequence): Connection establish request (SYN): server port 22]
[Connection establish request (SYN): server port 22]
[Severity level: Chat]
[Group: Sequence]
.... .... ...0 = Fin: Not set
[TCP Flags: ··········S·]
Window: 65495
[Calculated window size: 65495]
Checksum: 0xfe30 [unverified]
[Checksum Status: Unverified]
Urgent Pointer: 0
Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
TCP Option - Maximum segment size: 65495 bytes
Kind: Maximum Segment Size (2)
Length: 4
MSS Value: 65495
TCP Option - SACK permitted
Kind: SACK Permitted (4)
Length: 2
TCP Option - Timestamps: TSval 696235419, TSecr 0
Kind: Time Stamp Option (8)
Length: 10
Timestamp value: 696235419
Timestamp echo reply: 0
TCP Option - No-Operation (NOP)
Kind: No-Operation (1)
TCP Option - Window scale: 10 (multiply by 1024)
Kind: Window Scale (3)
Length: 3
Shift count: 10
[Multiplier: 1024]
[Timestamps]
[Time since first frame in this TCP stream: 0.000000000 seconds]
[Time since previous frame in this TCP stream: 0.000000000 seconds]
まとめ
とりあえず，SYNスキャンとコネクトスキャンで飛んでいるSYNパケットは完全に同じものではないことがわかった。
実際のファイヤーウォールの検知ルールがわからない限り，詳細の分析はできないので今回はここまでとする。
もし，本来空いているはずのportがスキャナによりfilterd判定された場合には，別のスキャン方法を試すと面白いと思う。