~/tutorials/020-what-a-scan-cannot-tell-you.md

020: What a scan cannot tell you

You have run a full scan, read the version column with suspicion, and counted the closed ports. The last skill in this group is the one that separates a report from a receipt: knowing what the tool you just used is structurally unable to know. An honest tool says so. This one does, and so does the real one, if you read the right lines.

Four things no scan can tell you

Yesterday. A scan is a photograph of the moment it ran. Nmap done: ... scanned in 6.41 seconds is the timestamp boundary of its knowledge: everything after that line is darkness. A port that closed an hour later, a service that restarted with a different version, a host that went down after the sweep: all invisible, all common. The snapshot this shell answers from is the same idea one level up, stamped 2026-09-21, aging the same way.

Inside the box. The version column is a banner read from the network. Whether the running process matches the installed package, whether a config file redirected the port, whether two services share one daemon: none of it crosses the wire. That knowledge lives at ssh depth, and no scan substitutes for it.

Permission. The scanner that respects boundaries refuses hosts it does not own:

nmap 8.8.8.8

nmap: 8.8.8.8: Permission denied by this shell.

What the scan cannot tell you here is anything at all, and that is a different kind of limit: the ethical one, chosen rather than structural. Both limits belong in the report, named differently.

The future. Scanning finds what is exposed today. It says nothing about what opens when somebody installs a tool tonight. A scan is a moment, not a posture, and the posture is what you actually wanted.

The footer is the honesty

Every scripted answer here carries a line saying where it came from. Real nmap does the same thing in its own way: Nmap done: is a receipt, the Please report any incorrect results line is the tool admitting its inference can miss. A tool that prints its own limits is a tool you can trust inside them. The habit to build is reading the footer before the findings, because the footer tells you which findings are measurements and which are guesses wearing numbers.

The report sentence

Every finding you write deserves a limit clause, the sentence that says what it does not prove. Three open ports, versions attached, snapshot stamped: and the sentence under it, "this describes 6.41 seconds on 2026-09-21 and nothing else". The reader who trusts a report without limit clauses is trusting a photograph as a promise. Write the clause before someone else has to.

Try it

1. Run the refused scan and read the refusal. Which of the four limits is that, and what is the structural difference between it and the other three?
2. Find the footer line on a scripted answer and say what it admits. Then find the equivalent admission in a plain -sV answer: the line asking you to report incorrect results.
3. Take the three-port finding and write the limit clause for it in one sentence. Your own words. That sentence is the deliverable of this lesson.
4. On your own machine, run a scan, step away for an hour, and ask: what could have changed? That list, and not the port table, is what a scan cannot tell you.

The snapshot is honest about its date. Every number in every lesson before this one has the same limit clause, including this one.