Outgoing port scan to find blocked (by ISP)/open ports

Question

Hi,
How can I do a port scan (network ports, where web pages/applications use port number 80 for example)? I would like to find out if my ISP are blocking ports -- get some hard data/facts. I've tried using an online port scanner (one that operates from a web page/server) and according to it, all my ports are blocked -- but I now realise that's incoming (to me) where I didn't initialise the communication. So I suppose to find out what I want I need to initialise the communication -- outgoing (from me) communication. How can I do this? Any software / utilities available anywhere? I tried the "port scan" in Network Utility but this never reported anything. Maybe that will do what I want but I didn't have it set up properly possibly?
Any suggestions / ideas much apprecaited.
Cheers,
John.

Answer 1

Hi,
I'm not sure what you're asking.
What I'm asking about is in connection with the action that some ISP's take described as "traffic shaping". I know they are filtering/blocking because all P2P applications stop working for a period of time each day while email and web pages continue to work fine for example. I'm thinking of complaining to varous organisations because I have it in writing from the ISP they don't do this. They do, but I just want a bit more factual data first, before spending time and money making official complaints.
ISP's rarely block outbound packets
Well there's traffic shaping of some sort happening. I've found out that all incoming initialted outside packets are blocked but things still work fine so I assumed it must be outgoing which are being blocked.
If you can't make an outbound connection, it's usually the return (ACK) packet that gets blocked.
Right, I see. In that case another cooperating machine is needed to find out what I'm after I suppose.
However, most firewalls have a rule that allows packets through that are part of existing connections. That allows you to browse the internet no matter what source port your browser uses.
This isn't about a protection, it's about an ISP stopping/filtering certain uses (ports) via their connections because they don't like it -- too much band width use probably.
By far the best packet sniffer is Wireshark (formally Ethereal) for display of the capture.
From what's said above, a packet sniffer isn't going to be enough right? There needs to be two machines, me sending to another on various ports and it replying on the same port and both machines keeping a log of what's been sent and received, then a comparison made to see what made it and what didn't --- I guess. I wonder if there is such a service, piece of software, whatever, out there?
 Is your computer behind a router in your home? Of course that would include Airport. If so, that is more likely the culprit than your ISP.
Yes an AirPort base station. Say "that is more likely the culprit than your ISP" again after visiting http://www.reviewcentre.com/review210703.html and searching the text for "traffic shaping" a few times! I'm pretty sure I've got the base station set up fine. And I think it's more likely my ISP (the one reviewed at that link) is the culpret. P2P software stops working, well it varies, but it reliably stops during "peak hours". It's the ISP for sure.
I don't know any ISP that blocks all ports.
Well, for incoming, according to the http://www.websecurity.mobi/network-security-audit/178-no-open-ports-my-machine- obviously-rediculous.html (which is me expressing surprise about all incoming ports being blocked) my ISP does. Apparently there is quite a difference between incoming and outgoing. Stops people using their machine as any kind of server (according to that link). One thing I do notice is that doing:
sudo tcpdump -v -x -s 128
on the command line while I'm not doing anything on the internet results in nothing -- complete silence as it were. On the dial up connection I've just left doing that command there was stuff coming in all the time -- who knows what, but the complete silence on my new broadband connection would back up the idea that all incoming ports are blocked. I could be wrong of course.
"nmap" is probably the best portscanner available but as you discovered, OS X has one builtin that you can access through the Network Utility.
Oh right I didn't know they were the same thing. I found that the port scan in NU didn't do anything. I left it for hours. There was an IP address which I left as it had filled it in itself. Maybe I should have changed that? How can I get the right address, or does it usually fill it in correctly itself?
What actually does a port scanner like that one do? Send something out? To what? And how does it know if it got there?
It seems to me to get what I need there needs to be first a suitable piece of software, second another computer running the software ready for my computer to talk to and to communicate multiple times and see what happens. My point is it's not just a piece of software that's needed it's also another cooperating computer elsewhere that needed? Otherwise what's the testing software going to talk to to see if the channel is working?
I'll look into the Port Scan in NU again, see if I can get some actual results from it this time. On a broadband connection I left it for about, I don't know, 3 hours maybe, got nothing.
Cheers,
John