I performed an nmap scan first via nmap address). It returned 999 ports closed, port 631 is open(correct since netstat -tlpn also shows port 631 is listening). Then I did a port scan via nmap my ip address. It then returned the result that all 1000 ports are closed. Why the difference between the two results when they are just scanning my local PC?

  • And what exactly does netstat -tlpn say about port 631? – muru Aug 10 '15 at 11:37
  • It says that it is listening for connections. It's the Internet Printing Protocol,afaik. – Mayank Singh Aug 10 '15 at 11:49
  • I meant exactly. Not your interpretation of it or what port 631 is. – muru Aug 10 '15 at 11:58
  • tcp 0 0* LISTEN - tcp6 0 0 ::1:631 :::* LISTEN - – Mayank Singh Aug 10 '15 at 12:11

You have different answer because fist scan to is do not go through firewall. Second scan also included firewall rules.

Port status

Open State

An application is actively accepting TCP connections, UDP datagrams or SCTP associations on this port. Finding these is often the primary goal of port scanning. Security-minded people know that each open port is an avenue for attack. Attackers and pen-testers want to exploit the open ports, while administrators try to close or protect them with firewalls without thwarting legitimate users. Open ports are also interesting for non-security scans because they show services available for use on the network.

Closed State

A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next.

Filtered State

Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically.

Unfiltered State

The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Scanning unfiltered ports with other scan types such as Window scan, SYN scan, or FIN scan, may help resolve whether the port is open.

Open & Filtered State

Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way.

Closed & Filtered State

This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IP ID idle scan.

So in your case, the closed state of port might be because you don't have application listening on it.

  • If second scan also includes firewall rules, then shouldn't the result be that 1000 ports are filtered rather than that they are closed since the firewall rules are set to deny incoming and deny outgoing(and exceptions added for outbound firewall later.) – Mayank Singh Aug 10 '15 at 11:13
  • I add port status and comment to my answer – 2707974 Aug 10 '15 at 11:27
  • I have the firewall properly configured, so according to the above documentation, nmap's probes should be blocked by the firewall and 1000 ports are filtered should be shown instead of "1000 ports are closed" – Mayank Singh Aug 10 '15 at 11:31
  • A closed port will actively (and helpfully) send a "connection denied" message back to the client. A filtered port will send back nothing at all. A firewall will try to supply as little information as possible, so it will not even tell the client that the ports are closed. – Jos Aug 10 '15 at 12:06

Since nmap shows only one open port for localhost and none for your external IP, one simple conclusion is that you have only one service listening, and it is listening only on localhost. The output of netstat for that port confirms this, since the service is listening only on (IPv4 localhost) and ::1:631 (IPv6 localhost).


When a program opens a listening TCP socket, it must first bind that socket to an address and port number. Most commonly, the address will be INADDR_ANY, which on Linux is the address. This means "any address on any interface may connect." The other common alternative is to bind to the address configured on a particular interface: either your device's outward-facing IP address or the special address of the loopback adapter (lo)

In your case, CUPS is listening on port 631 on loopback. This means it cannot be contacted on any other address, even by Nmap. This makes sense for a system that uses CUPS for printing services but is not configured to be a print server for other systems on your network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.