Tuesday, September 27, 2016

which are the 1000 common NMAP TCP Ports?

NMAP has a list of the most common 1000 TCP ports included, and which they are is always a little bit a mysterie.

To check which are these ports, i downloaded NMAP stable 7.12 and searched how NMAP handles this 1000 common ports.

there is a nmap-services file in the root folder of the NMAP installation which has a list of ports (TCP/UDP) each with a open-frequency.  port TCP/80 for example has the highest open-frequency with 0.484143.

the source of services.cc shows that the file is opened each time, and not compiled inside the binaries, so a modification of nmap-services will affect the port list immediatley.  the function simple sorts and gets the 1000 most common ports depending on their open frequency.

version 7.12 common ports, sorted => http://pastebin.com/rU4L4Sj6