Including the reason for a port or host state
To make Nmap include the reason why a port is marked as opened or closed and why the host is marked as alive, use the --reason option, as shown in the following command:
$ nmap --reason <target>
The --reason option will make Nmap include the packet type that determined the port and host state. We have the following example:
$ nmap --reason scanme.nmap.org Nmap scan report for scanme.nmap.org (74.207.244.221) Host is up, received echo-reply (0.12s latency). Not shown: 96 closed ports Reason: 96 resets PORT STATE SERVICE REASON 22/tcp open sshsyn-ack 25/tcp filtered smtp no-response 80/tcp open http syn-ack 646/tcp filtered ldp no-response Nmap done: 1 IP address (1 host up) scanned in 3.60 seconds
