CEH Footprinting, Reconnaissance and Scanning Practice Question

A security analyst runs the command: nmap -sS -p 80,443,8080 --script http-headers scanme.nmap.org. The output shows that port 80 is filtered. What does 'filtered' mean in this context?

⚠ Common exam trap

It's easy for candidates to confuse 'filtered' with 'closed' or 'open|filtered', forgetting that 'filtered' specifically indicates a firewall or IDS is interfering, not that the port is simply unresponsive or sending RSTs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A firewall or IDS is preventing the probe from reaching the port

In Nmap, a 'filtered' port status indicates that the port is being blocked by a firewall, IDS, or other network filtering device, preventing the probe from reaching the target service. The -sS (SYN stealth scan) sends a SYN packet; if no response is received or an ICMP unreachable (type 3, code 13) is returned, Nmap marks the port as filtered. This does not mean the port is open or closed—it means the scan could not determine the state due to filtering.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The port is open, but the service is not responding
Why it's wrong here
If a service is not responding at the application layer, the underlying TCP port can still be 'open' and the host's TCP/IP stack will send a SYN-ACK in response to Nmap's SYN probe. The 'filtered' state, however, indicates that Nmap received no response at all, meaning the probe likely never reached the host or its response was blocked. This suggests an issue at the network or transport layer, not just the application layer.
✗
The port is open and actively listening
Why it's wrong here
An 'open' port, by Nmap's definition in a SYN scan, means the target host responded with a SYN-ACK packet, indicating a service is actively listening and ready to establish a connection. The 'filtered' state, conversely, signifies that Nmap received no response whatsoever to its SYN probe. This lack of any reply prevents Nmap from confirming the port's availability, strongly suggesting an intervening device is preventing communication.
✗
The port is closed, but the target is responding with RST packets
Why it's wrong here
A port classified as 'closed' by Nmap's SYN scan explicitly means the target host received the SYN probe and responded with a RST (Reset) packet, indicating no application is listening on that specific port. This definitive rejection allows Nmap to confirm the port's status as unavailable. The 'filtered' state, however, implies that no RST packet was ever received, signifying that the probe was likely dropped before reaching the target or its response was suppressed.
✓
A firewall or IDS is preventing the probe from reaching the port
Why this is correct
The 'filtered' state in an Nmap SYN scan is a critical indicator that the probe packet sent by Nmap did not receive any response from the target host. This typically occurs when a network filtering device, such as a firewall, an Intrusion Detection System (IDS), or an access control list (ACL) on a router, intercepts and drops the SYN packet. Consequently, Nmap cannot determine if the port is open or closed because the communication path is obstructed.

Visual reference

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question