Including the reason for a port or host state

To make Nmap include the reason why a port is marked as opened or closed and why the host is marked as alive, use the --reason option, as shown in the following command:

$ nmap --reason <target>

The --reason option will make Nmap include the packet type that determined the port and host state. We have the following example:

$ nmap --reason scanme.nmap.org
Nmap scan report for scanme.nmap.org (74.207.244.221) Host is up, received echo-reply (0.12s latency).
Not shown: 96 closed ports Reason: 96 resets
PORT  STATE     SERVICE REASON
22/tcp    open   sshsyn-ack
25/tcp   filtered smtp    no-response 80/tcp    open  http    syn-ack 646/tcp filtered ldp    no-response
Nmap done: 1 IP address (1 host up) scanned in 3.60 seconds