Checking if a port is open using Nmap doesn't work

FabArd08

I'm running NetBSD 11.0 RC4 and I want to check whether port 5353 on a host on my network is open for the UDP protocol. I'm using the following command:
nmap -sU -p 5353 192.168.1.225
I'm not getting any results.
Just to clarify, the npf firewall is not active.
Could someone tell me why this isn't working?

Jay

FabArd08 hi. Are you using sudo or directly trying with root account?

rvp

FabArd08 It works as far as I can see. What's the difference that you're seeing?

Script started on Thu Jun  4 12:25:43 2026
CoreBook# uname -mr
11.99.6 amd64

CoreBook# nmap -V
Nmap version 7.98 ( https://nmap.org )
Platform: x86_64--netbsd
Compiled with: openssl-3.5.6 libssh2-1.11.1 libz-1.3.1 libpcre2-10.47 libpcap-1.10.6 nmap-libdnet-1.18.0 ipv6
Compiled without: liblua
Available nsock engines: kqueue poll select

CoreBook# nmap -sU -p 53 192.168.68.1
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-04 12:26 +0000
Nmap scan report for gateway.local (192.168.68.1)
Host is up (0.0033s latency).

PORT   STATE SERVICE
53/udp open  domain
MAC Address: D8:47:32:A8:B2:88 (TP-Link Technologies)

Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds

CoreBook# nmap -sU -p 555 192.168.68.1
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-04 12:26 +0000
Nmap scan report for gateway.local (192.168.68.1)
Host is up (0.0037s latency).

PORT    STATE  SERVICE
555/udp closed dsf
MAC Address: D8:47:32:A8:B2:88 (TP-Link Technologies)

Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds

CoreBook# ^D

Script done on Thu Jun  4 12:26:55 2026

(The session above was run on 11.99.6, but, the output is the same for 11.0_RC4/amd64 in QEMU.)

FabArd08

I use it as root with the su- command

FabArd08

I tried it on a fresh 10.1 installation, and it doesn't work there either.

FabArd08

uname -mr
10.1 amd64

nmap -v
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-04 15:10 +0200
Read data files from: /usr/pkg/bin/../share/nmap
WARNING: No targets were specified, so 0 hosts scanned.
Nmap done: 0 IP addresses (0 hosts up) scanned in 0.08 seconds
           Raw packets sent: 0 (0B) | Rcvd: 0 (0B)

nmap -sU -p 53 192.168.1.1
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-04 15:18 +0200
^C

I exited the command with CTRL-C because it wasn't displaying anything

nmap -sU -p 555 192.168.1.1
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-04 15:33 +0200
^C

I exited the command with CTRL-C because it wasn't displaying anything

The only IP address that works is 127.0.0.1:

nmap -sU -p 53 127.0.0.1
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-04 15:35 +0200
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000033s latency).

PORT    STATE SERVICE
53/udp closed domain

Nmap done: 1 IP address (1 host up) scanned in 1.31 seconds

Just to clarify, I'm using the iwn0 network interface

rvp

FabArd08 The only IP address that works is 127.0.0.1:

The host might be blocking ICMP responses to defeat port-scanning. Run tcpdump on the interface to see if the host's sending back any ICMP Port Unreachable responses.

UDP's a connection-less protocol, so if the host just drops packets w/o sending any kind of response, nmap will just have to time out.

FabArd08

I ran a test using FreeBSD 15.0 on a physical machine:

On FreeBSD (IP 192.168.1.224)

nmap -sU -p 5353 192.168.1.225
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-05 10:22 +0200
Nmap scan report for 192.168.1.225
Host is up (0.0027s latency).

PORT     STATE SERVICE
5353/udp open  zeroconf
MAC Address:<my mac address>

Nmap done: 1 IP address (1 host up) scanned in 0.91 seconds


On Artix (IP 192.168.1.225)

sudo tcpdump -i wlan0 -n 'host 192.168.1.224 and (host 192.168.1.225)'
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
10:22:28.648265 ARP, Request who-has 192.168.1.225 tell 192.168.1.224, length 28
10:22:28.648289 ARP, Reply 192.168.1.225 is-at <my mac address>, length 28
10:22:29.463231 IP 192.168.1.224.48820 > 192.168.1.225.5353: 58112% [b2&3=0x4fa] [1n] Type0 (Class 0) (QM)? . (48)
10:22:29.463461 IP 192.168.1.224.48820 > 192.168.1.225.5353: 0 PTR (QM)? _services._dns-sd._udp.local. (46)
10:22:29.463638 IP 192.168.1.225.5353 > 192.168.1.224.48820: 0*- 1/0/0 PTR _workstation._tcp.local. (78)
10:22:29.463750 IP 192.168.1.224.48820 > 192.168.1.225.5353: 0 PTR (QU)? _services._dns-sd._udp.local. (46)
10:22:29.463906 IP 192.168.1.225.5353 > 192.168.1.224.48820: 0*- 1/0/0 PTR _workstation._tcp.local. (78)
10:22:29.465328 IP 192.168.1.224 > 192.168.1.225: ICMP 192.168.1.224 udp port 48820 unreachable, length 114
10:22:29.465593 IP 192.168.1.224 > 192.168.1.225: ICMP 192.168.1.224 udp port 48820 unreachable, length 114
10:22:34.736545 ARP, Request who-has 192.168.1.224 tell 192.168.1.225, length 28
10:22:34.739042 ARP, Reply 192.168.1.224 is-at <my mac address>, length 28
^C
11 packets captured
11 packets received by filter
0 packets dropped by kernel

I did the same thing with NetBSD 10.1 on a fresh installation on a physical machine with only one package installed using pkgin in nmap

On NetBSD (IP 192.168.1.230)

nmap -sU -p 5353 192.168.1.225
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-05 11:06 +0200


On Artix (IP 192.168.1.225)

sudo tcpdump -i wlan0 -n 'host 192.168.1.230 and (host 192.168.1.225)'
[sudo] Mot de passe de fabrice :
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
11:06:18.837656 ARP, Request who-has 192.168.1.225 tell 192.168.1.230, length 46
11:06:18.837693 ARP, Reply 192.168.1.225 is-at <my mac address>, length 28
^C
2 packets captured
2 packets received by filter
0 packets dropped by kernel

Nmap installed from binary packages does not work on NetBSD.

rvp

FabArd08 Nmap installed from binary packages does not work on NetBSD.

Strange, it does for me, as you saw. Can you try a scan with nc--You'll have to apply the patch below.

nc -uvz 192.168.1.225 5353 5555

(that's one known open port and one known closed port.)
Collect the tcpdump output here too.

`nc` patch

diff -urN usr.bin/nc.orig/netcat.c usr.bin/nc/netcat.c
--- usr.bin/nc.orig/netcat.c	2026-03-03 03:54:49.716087313 +0000
+++ usr.bin/nc/netcat.c	2026-06-04 11:37:51.676518886 +0000
@@ -1518,6 +1518,8 @@
 	}
 }
 
+#define UDP_SCAN_TIMEOUT	3	/* seconds */
+
 /*
  * udptest()
  * Do a few writes to see if the UDP port is there.
@@ -1526,15 +1528,23 @@
 int
 udptest(int s)
 {
-	int i, ret;
+	int i, t = (timeout == -1) ? UDP_SCAN_TIMEOUT : (timeout / 1000);
+ 
+ 	/* Only write to the socket in scan mode or interactive mode. */
+ 	if (!zflag && !isatty(STDIN_FILENO))
+ 		return 0;
+ 
+	if ((write(s, "X", 1) != 1) ||
+	    ((write(s, "X", 1) != 1) && (errno == ECONNREFUSED)))
+		return -1;
 
-	for (i = 0; i <= 3; i++) {
-		if (write(s, "X", 1) == 1)
-			ret = 1;
-		else
-			ret = -1;
-	}
-	return (ret);
+	/* Give the remote host some time to reply. */
+	for (i = 0; i < t; i++) {
+		sleep(1);
+		if ((write(s, "X", 1) != 1) && (errno == ECONNREFUSED))
+			return -1;
+ 	}
+	return 1;
 }
 
 void

smurfd

or just try a telnet from the netbsd to verify that you are able to reach it (but i guess otherwise it would say trying...) sorry to jump in, please continue with rvp's path above.

telnet 192.168.1.225 5353

From netbsd 10.1 stable

$ doas nmap -sU -p 22 192.168.0.10
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-07 21:12 +0200
Nmap scan report for 192.168.0.10
Host is up (0.00012s latency).

PORT   STATE         SERVICE
22/udp open|filtered ssh

FabArd08

I wondered why it worked elsewhere but not at my place. I concluded that if there was a problem, it might be due to my network. My network consists solely of a router that also acts as a hub and a DHCP server. I performed a hard reset on my router and was surprised to find that everything worked afterward. What I don’t understand is how the same problem could have occurred on two different machines with two different network interfaces (Wi-Fi and Ethernet) and two different IP addresses???

Thank you for your help.