Nmap Main Scan types -sR

RPC scanning (-sR)

RPC scanning method always works in combination with several of port scan methods of Nmap.  The idea of this is that try to determine the target ports are RPC ports or not.  Decoys are not used in RPC scanning.

#nmap –sR –v 10.50.1.254

Starting nmap V. 2.54BETA30

Host vpn1-gw.lab.tct.hut.fi (10.50.1.254) appears to be up ... good.

Initiating Connect() Scan against vpn1-gw.lab.tct.hut.fi (10.50.1.254)

Adding open port 23/tcp

Adding open port 80/tcp

Adding open port 139/tcp

Adding open port 1723/tcp

Adding open port 24/tcp

Adding open port 515/tcp

The Connect() Scan took 1 second to scan 1549 ports.

Interesting ports on vpn1-gw.lab.tct.hut.fi (10.50.1.254):

(The 1543 ports scanned but not shown below are in state: closed)

Port       State       Service (RPC)

23/tcp     open        telnet                 

24/tcp     open        priv-mail              

80/tcp     open        http                   

139/tcp    open        netbios-ssn            

515/tcp    open        printer                

1723/tcp   open        pptp                   

Nmap run completed -- 1 IP address (1 host up) scanned in 1 second