L13
Nmap and interpreting port scans
Cram this first — memory hook
Open = listener; closed = no listener observed; filtered = view obstructed.
Exam trap
Silence is not proof that a service is absent. A firewall can hide it from one scanning location.
The slide facts
Network Mapper supports discovery and auditing. The scan slide lists SYN, connect and User Datagram Protocol techniques, port selection, service detection and an aggressive scan option.
If you have time — extra
Network Mapper () helps identify hosts and exposed services on networks you are authorized to examine. An open result suggests a listening service. Closed normally means the endpoint is reachable but nothing is listening at that tested port. Filtered means the scanner cannot determine the port's state because filtering or another obstruction prevents a decisive response. scans can produce open|filtered when silence cannot distinguish the possibilities. These are observations from the scanner's position, not permanent properties visible identically from everywhere. For recognizing supplied commands: -sS denotes a Transmission Control Protocol SYN scan, -sT a connect scan, -sU a scan, -p selects ports, and -sV probes service versions. -A enables several detection features; it is not a synonym for scan all ports. Knowing a service version helps investigation but does not by itself prove exploitability.
Walkthrough
Identify the authorized target and scope, interpret the reported host/port/protocol/state, distinguish guessed service labels from actual detection, and compare results with intended exposure and firewall policy.