Why Nmap says a port is filtered: using --reason, -v, and --packet-trace

--reason adds the evidence column

--reason adds a REASON column such as syn-ack, reset, no-response, port-unreach, admin-prohibited, or conn-refused, along with the TTL of the reply. That one column turns a state into evidence. “filtered (admin-prohibited from 10.0.0.1)” tells you a router at 10.0.0.1 sent an ICMP rejection, which points straight at the device whose ACL to read.

Reply TTLs are a subtle clue. If open ports reply with TTL 63 and closed ports with TTL 254, the RSTs are probably coming from a firewall in front of the host, not the host itself.

Verbosity and debugging

-v prints open ports as they are found and summarizes timing. -vv adds more. -d and -dd show internal decisions such as timeout changes. Press v or d during a running scan to raise the level without restarting, and press any other key for a progress estimate.

--packet-trace prints a line for every packet sent and received. It is too noisy for large scans but perfect for a single port that is behaving oddly.

Snippet

sudo nmap -p 22,80,3389 --reason 192.168.56.101
sudo nmap -p 3389 --packet-trace -n 192.168.56.101

Lab: find the device that rejected you

Put a second VM between the scanner and the target as a simple router, and add an iptables FORWARD rule that rejects TCP 3389 with icmp-admin-prohibited. Scan the target from the scanner with --reason. The output should name the router’s address as the source of the rejection, not the target.

Add --packet-trace and confirm the ICMP type 3 code 13 packet coming from the router. That chain of evidence is what you include when asking a network team to change an ACL.

Snippet

# on the router VM
sudo iptables -A FORWARD -p tcp --dport 3389 -j REJECT --reject-with icmp-admin-prohibited
# scanner
sudo nmap -p 3389 --reason --packet-trace 10.20.0.15

Make --reason a habit

There is little cost to always adding --reason. It makes saved output self-explaining months later.

When a colleague questions a result, rerun the single port with --packet-trace and share the trace. Packets end arguments faster than opinions.

Diagram

Common reasons and what to do next

Read the REASON column before the STATE column.

syn-ack
Open. A service accepted the handshake.
reset
Closed, or a firewall sending RSTs. Check the TTL.
no-response
Filtered by a silent drop.
admin-prohibited from X
A device at X rejected the packet. Read its rules.

Check yourself

1. Which option adds the reason and reply TTL for each port?

2. Open ports reply with TTL 63, closed ports with TTL 254. What does that suggest?

3. Which option shows every packet Nmap sends and receives?