Often penetration testing engagements start with good old –*port scanning*–. Nmap is often the tool to use for it:

nmap -p- [ip-address-here] –open -T3

-T argument is a parameter of time, and it is an important one. Here is the table illustrating different timing modes:

Two important details from the table above:

• scan_delay – specifies the amount of time nmap will pause between each request. For instance, T0 – the slowest scan, will pause for 5 min between each packet.
• max_parallelism – displays whether the scan is running in parallel (multiple probes at the same time) or in serial mode (probe is sent one after another – much slower)

When this can come in handy? During red-team engagements when you need to stay under the radar. Or even ordinary pentesting engagements. I had a situation where the default nmap scan (T3) turned out a strange results with numerous open ports.

So this looked suspicious, and I was advised to look into it deeper. One thing to notice is how open ports appear one after another, almost sequentially – definitely something fishy going on.

Upon doing some research I realized this is the client’s firewall or IPS/IDS (intrusion prevention/detection systems) at work which are configured in such a way as when detecting port scanning they would respond with fake packets – creating the illusion of open ports.

One way I was able to bypass it was by making my scan slower. Lowering nmap to polite scan -T2 solved the problem, showing only two ports open (instead of hundreds fake open ports before).