After configuring the screen option on an SRX device, the device is shown to have opened ports that are not configured, during a port scan by NMAP. The article explains this behavior of the SRX device and whether any action must be taken.

After configuring the screen option on an SRX device, if software such as NMAP is used to perform a port scan on the network, it is sometimes reported that the SRX device has opened ports that are not configured.

An example of performing a port scan on an SRX device by using NMAP, with and without the screen option, is given below:

With the Screen Option

root@SRX240_3# run show configuration |display set
set version 12.3X48-D60.2
set system root-authentication encrypted-password "$ABC123"
set system services ftp
set system services ssh
set system services telnet
set system services web-management http
set system services web-management https system-generated-certificate
……
set security screen ids-option scan-test tcp syn-flood attack-threshold 10
set security policies from-zone scan-test to-zone junos-host policy permit match source-address any
set security policies from-zone scan-test to-zone junos-host policy permit match destination-address any
set security policies from-zone scan-test to-zone junos-host policy permit match application any
set security policies from-zone scan-test to-zone junos-host policy permit then permit
set security policies from-zone scan-test to-zone junos-host policy permit then log session-init
set security policies from-zone scan-test to-zone junos-host policy permit then log session-close
set security zones security-zone scan-test screen scan-test
set security zones security-zone scan-test interfaces ge-0/0/3.0
set interfaces ge-0/0/3 unit 0 family inet address 10.10.10.1

……

nmap -sS 10.10.10.1

Nmap scan report for 10.10.10.1
Host is up (0.0051s latency).
Not shown: 967 filtered ports
PORT      STATE  SERVICE
7/tcp     closed echo
21/tcp    open   ftp
22/tcp    open   ssh
23/tcp    open   telnet
53/tcp    closed domain
79/tcp    closed finger
80/tcp    open   http
85/tcp    open   mit-ml-dev
111/tcp   open   rpcbind
113/tcp   closed ident
443/tcp   open   https
513/tcp   closed login
514/tcp   closed shell
554/tcp   open   rtsp
1002/tcp  open   windows-icfw
1031/tcp  open   iad2
1086/tcp  open   cplscrambler-lg
1720/tcp  open   h323q931
1723/tcp  open   pptp
2007/tcp  open   dectalk
3221/tcp  closed xnm-clear-text
5060/tcp  closed sip
5906/tcp  open   unknown
5950/tcp  open   unknown
5988/tcp  open   wbem-http
8080/tcp  closed http-proxy
8443/tcp  closed https-alt
9102/tcp  open   jetdirect
9998/tcp  open   distinct32
25735/tcp open   unknown
31337/tcp open   Elite
33899/tcp closed unknown
49155/tcp open   unknown

Nmap done: 1 IP address (1 host up) scanned in 47.96 seconds

Without the Screen Option

[edit]
root@SRX240_3# run show configuration |display set
set version 12.3X48-D60.2
set system root-authentication encrypted-password "$ABC123"
set system services ftp
set system services ssh
set system services telnet
set system services web-management http
set system services web-management https system-generated-certificate
……
set security policies from-zone scan-test to-zone junos-host policy permit match source-address any
set security policies from-zone scan-test to-zone junos-host policy permit match destination-address any
set security policies from-zone scan-test to-zone junos-host policy permit match application any
set security policies from-zone scan-test to-zone junos-host policy permit then permit
set security policies from-zone scan-test to-zone junos-host policy permit then log session-init
set security policies from-zone scan-test to-zone junos-host policy permit then log session-close
set security zones security-zone scan-test host-inbound-traffic system-services all
set security zones security-zone scan-test interfaces ge-0/0/3.0
set interfaces ge-0/0/3 unit 0 family inet address 10.10.10.1
……
 
nmap -sS 10.10.10.1
 
Nmap scan report for 10.10.10.1
Host is up (0.0053s latency).
Not shown: 984 filtered ports
PORT      STATE  SERVICE
7/tcp     closed echo
21/tcp    open   ftp
22/tcp    open   ssh
23/tcp    open   telnet
53/tcp    closed domain
79/tcp    closed finger
80/tcp    open   http
113/tcp   closed ident
443/tcp   open   https
513/tcp   closed login
514/tcp   closed shell
3221/tcp  closed xnm-clear-text
5060/tcp  closed sip
8080/tcp  closed http-proxy
8443/tcp  closed https-alt
33899/tcp closed unknown
 
NMAP done: 1 IP address (1 host up) scanned in 11.19 seconds

Note the following in the above example:

• Without the screen option, only the configured FTP, SSH, Telnet, HTTP, and HTTPS ports are opened.
• With the screen option, several unconfigured ports are shown to have been opened even though the command was to open only the configured FTP, SSH, Telnet, HTTP, and HTTPS ports.

This behavior is part of the "syn-flood" protection design. NMAP clients send syn packets with the same destination IP address for port scan. Following this, the SRX device intercepts the connection request and proxies a SYN/ACK packet through the same ingress interface when the packet reaches the specified threshold.

For more information about SYN flood attacks, see Understanding SYN Flood Attacks .

No action is required on the SRX device.

These states are not intrinsic properties of the port itself, but describe how NMAP sees them.