diff -ur nmap-3.78/portlist.h nmap-3.78mm/portlist.h --- nmap-3.78/portlist.h 2004-11-12 21:21:27.000000000 +0100 +++ nmap-3.78mm/portlist.h 2004-12-21 13:58:01.000000000 +0100 @@ -113,7 +113,7 @@ #define PORT_FRESH 5 #define PORT_UNFILTERED 6 #define PORT_OPENFILTERED 7 /* Like udp/fin/xmas/null/ipproto scan with no response */ -#define PORT_CLOSEDFILTERED 8 /* Idle scan */ +#define PORT_CLOSEDFILTERED 8 /* Idle scan or CONNECT returned ECONNREFUSED (RST or ICMP Port Unreachable) */ #define PORT_HIGHEST_STATE 9 /* ***IMPORTANT -- BUMP THIS UP WHEN STATES ARE ADDED *** */ diff -ur nmap-3.78/scan_engine.cc nmap-3.78mm/scan_engine.cc --- nmap-3.78/scan_engine.cc 2004-12-21 14:36:48.000000000 +0100 +++ nmap-3.78mm/scan_engine.cc 2004-12-21 14:34:36.000000000 +0100 @@ -1685,7 +1685,8 @@ if (probe->isPing()) ultrascan_ping_update(USI, hss, probeI, &USI->now); else - ultrascan_port_update(USI, hss, probeI, PORT_CLOSED, &USI->now); + ultrascan_port_update(USI, hss, probeI, PORT_CLOSEDFILTERED, &USI->now); /* Could be FILTERED too since ICMP Port + Unreachable ends in ECONNREFUSED too */ break; } } @@ -2163,7 +2164,7 @@ newstate = PORT_FILTERED; break; case ECONNREFUSED: - newstate = PORT_CLOSED; + newstate = PORT_CLOSEDFILTERED; /* Could be FILTERED too since ICMP Port Unreachable ends in ECONNREFUSED too */ break; #ifdef ENOPROTOOPT case ENOPROTOOPT: