Labs / ethical hacking

Network Scanning with Nmap: Reading Port States Correctly

beginner EVE-NG/VM lab with a target VM and a firewall/ACL between attacker and target scanningnmapnetwork-security

Scenario

Authorization note: only scan systems in your own isolated lab — scanning any system you don’t own or have explicit written permission to test is illegal. Your goal is to run the standard scan types and correctly interpret open, closed, and filtered results — including when a firewall is involved.

What you need

  • An attacker VM with nmap installed.
  • A target VM with a few services running (SSH, a web server) — any Linux distro is fine for the basic version of this lab.
  • Optional: a router/firewall between them with an ACL blocking one specific port, to practice reading “filtered.”

Step 1 — Baseline: unfiltered scan

attacker$ nmap -sS 192.168.100.20

Record which ports show open. This is your baseline before any firewall is introduced.

Step 2 — Add a filtering rule

On the router/firewall between attacker and target, block one specific port (for example, block TCP 22 to the target):

R1(config)# access-list 150 deny tcp any host 192.168.100.20 eq 22
R1(config)# access-list 150 permit ip any any
R1(config)# interface g0/1
R1(config-if)# ip access-group 150 in

Step 3 — Re-scan and compare

attacker$ nmap -sS 192.168.100.20

Port 22 should now show as filtered instead of open or closed — nmap received no response at all, because the ACL silently dropped the probe.

Step 4 — Service and version detection

attacker$ nmap -sV 192.168.100.20

This adds banner-grabbing to identify the exact service version on each open port — the direct input to the enumeration phase.

Step 5 — Document the difference correctly

Write a short note explaining the difference you observed between “closed” (before the ACL) and “filtered” (after the ACL) on port 22 — this is one of the most common things beginners misinterpret in real scan output.

Break it

Remove the ACL and scan again with -sS vs -sT (TCP connect scan) and compare — notice -sT completes the full handshake while -sS does not, which matters for how “loud” (detectable) your scan is on the target.

Reference

  • AddySec original content — written for the Ethical Hacking track, building on Network Scanning Fundamentals.