Reading Scan Output Without Crossing Scope

When connect_ex((127.0.0.1, port)) returns 0, your process completed TCP with a listener on that port on this machine (or on a VM you own, if HOST were ever that VM under writing — it is not, in this script). OPEN does not name the program. OPEN does not mean vulnerable. OPEN does not mean you may brute SSH, send exploits, or enumerate Module 4 banners on a host you do not own. On loopback, OPEN on 8000 after you started http.server is the expected reward for a later lab, not a CVE write-up and not a reason to launch Metasploit. On a neighbor’s 445, OPEN is someone else’s door — and you should never have asked.

Write OPEN with the port, the host (127.0.0.1), the timeout, and the timestamp. That row is a network fact from your vantage point. If you did not start a listener and 22 reports OPEN, something on YOUR box is accepting SSH — useful hygiene, still not a license to attack it, still not a reason to scan the rest of the LAN “for comparison.” Identify YOUR process with tools on YOUR OS (ss, netstat, Resource Monitor) if you care. Do not identify someone else’s process by scanning them.

A beginner connect scan with a short settimeout lives in a messy middle. Immediate refuse (RST) often means “nothing accepted, and the stack said so.” Timeout often means “no useful answer in 0.5s” — nothing listening, a drop, a slow host, or a firewall that ate the SYN. Professional scanners spend pages distinguishing closed from filtered. This course will not spend those pages on nmap reason codes, because the extra certainty is how people justify more probes, more flags, and more targets. For Cyberlium Module 3, nonzero after a short wait is closed_or_filtered. Record the numeric connect_ex if you want, record the timeout value, and stop. Do not add a second scan type to “resolve filtered.” Do not increase timeout to 30 seconds on a /24.

Timeout on loopback is almost always “nothing here right now.” Loopback is fast. If 80 times out on 127.0.0.1, you probably do not have a local web server, or you pointed at the wrong port. Debug YOUR listeners. A useful failure: you started http.server on 8080 and scanned 8000 — write 8000 closed_or_filtered, then either scan 8080 on loopback or move the server. Do not “fix” it by scanning 192.168.1.1:80 because home routers often answer. That answer is not your assignment. Filtered-looking silence on loopback is still not a hunting license.

Many student laptops listen on none of 22, 80, 443, 8000. A four-line closed file is a perfect Lesson 3 artifact. The skill is interpreting absence without inventing a new target. “Hunt until something is open” is attacker folklore and a common unauthorized-scan confession: the person kept expanding scope until a door answered. This course grades the opposite habit. Write NO_OPEN_PORTS=true if it is true. Write that you will optionally start a listener in Lesson 4. Write that you will not nmap the internet, café, campus, or neighbor to fill the OPEN column. That paragraph is more professional than a screenshot of a stranger’s router UI.

Peer pressure will say otherwise. Discord trophy channels like OPEN lists. Ignore them. If a classmate pastes a café gateway banner and calls it reading output, that paste is evidence of the wrong lesson. Your job is to keep scan-output-notes.txt boring: host lock, port, state, timeout, ethics, legal line. Boring is in-scope. Exciting foreign IPs are out. chmod 600 so a shared lab PC account does not read even your boring file — hygiene does not wait for secrets.

A second empty-result trap is “I will just check the default gateway, that is basically mine.” Default gateways on café, hotel, campus, and many home ISPs are devices other people (or the carrier) administer. Checking them with a connect loop is still a scan of someone else’s listener. The only gateway this lesson will ever imply is 127.0.0.1 — which is not a gateway at all; it is your kernel talking to itself. If you administer a home router you bought and you someday write a dated RoE that names its LAN IP, that is a different document. It is not a silent extra row in scan-output-notes.txt. Keep the file about loopback facts so the quiz can test whether you know why the gateway was never invited.

OPEN does not mean “in scope.” Scope was decided before the first connect, by ownership or RoE. closed_or_filtered does not mean “try harder with a different IP.” Timeout does not mean “the real hosts are on the other side of this NAT, go find them.” Filtered does not mean “bypass the firewall next.” Those leaps are how reading output becomes exploitation and how a localhost lesson becomes a campus incident. Module 5 will later say a CVE match is not automatic RCE. This lesson says a port state is not automatic consent. Two different sentences, same discipline: do not inflate a fact into a license.

Defender translation on a box you own: OPEN on an unexpected port is a ticket — what process, why bound, can it be loopback-only or stopped. closed_or_filtered on ports you expected to serve is also a ticket — is the daemon down, bound to another address, firewalled from loopback somehow. You are reading YOUR inventory. You are not reading a shopping list of other people’s doors. If you administer a VM you created, the same translation applies to that VM after writing says you may scan it. This lesson’s code still refuses any host other than 127.0.0.1 so the translation cannot wander.

Write the translation as sentences, not as tool envy. “22 closed_or_filtered: I do not run sshd on this laptop.” “8000 closed_or_filtered: I have not started http.server yet.” “8000 OPEN: I started python -m http.server bound to loopback in Lesson 4.” Those sentences are how a junior analyst talks. “22 OPEN on the café AP, I should hydra it” is how an incident starts. This course will never ask you to hydra, hashcat, or Metasploit a scan row. Module 5 will later say a CVE ID is a name, not a shell. Hold that discipline now, while the only number on the page is a port state.

Run the interpreter on a computer you own. Fill every port row. If nothing is OPEN, write that fact and the sentence “I will not hunt another IP.” chmod 600. Windows: WSL/Git Bash or a tight profile ACL; Test-NetConnection 127.0.0.1 -Port 80 still loopback only — TcpTestSucceeded is a connect-style boolean, not a license to test the gateway.

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

cat >> "$NOTES" << 'EOF'
closed_or_filtered: nonzero, refuse, or timeout — honest beginner bucket
EOF

You can now read a beginner scan without turning silence into a raid. OPEN is a completed handshake with a listener you were allowed to ask. closed_or_filtered and timeout are honest buckets, not dares. Empty is valid. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to a CEH v13 domain — not official EC-Council training, not a cert, not exam dumps. Next — Lab — Scan 127.0.0.1 Only — hardcodes the same HOST, walks a tiny port list, optionally starts a local http.server on 8000, and writes ceh-scan.txt mode 600. Never nmap the internet, café, campus, or neighbor.