Scan a host you built and account for every difference

short · 50 min · Objective 2.2

Task

Scan a lab host whose configuration you already know, then account for every disagreement between what you know is there and what the scan reported. Learning a scanner's error bars against ground truth is the only way to know how far to trust it where you do not have the answers.

Steps

  1. On the lab network you own, build a target VM and write down the truth first: the services you installed, the ports you opened, the versions present, and what the host firewall should do.
  2. From the attacker VM, run a TCP scan with service and version detection against the target, saving output to /tmp/scan.txt.
  3. Run a UDP scan of a few known ports and note how much slower and more ambiguous the results are.
  4. Diff the scan against your written truth. For every difference, write the cause: timing too fast, a backported version, a filtered vs closed result, or a service you did not know was installed.
  5. Add a host firewall rule and rescan one port — watch closed become filtered — then record how you told them apart.

Verify

grep -cE "^[0-9]+/(tcp|udp)\s+(open|closed|filtered)" /tmp/scan.txt
grep -ciE "open" /tmp/scan.txt
grep -ciE "filtered|closed" /tmp/scan.txt

The first count must be non-zero — the scan reported port states in a parseable form. The second and third confirm you captured both reachable and unreachable-looking ports: a scan of a real host shows a mix, and a result that is uniformly one state usually means a firewall rather than a clean host. The learning is in your diff notes, but the scan must have produced states to diff.

Notes

Closed means a host answered and refused — it exists and is reachable — whereas filtered means something dropped the probe. UDP silence is ambiguous three ways at once, which is why UDP findings should say so. Writing the expected result down first is what makes this an experiment rather than a demonstration, and it is the habit that stops you reading a scan to confirm what you already believe.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.