Why do nmap -p <port> and nmap -A scans show different results?

By default, nmap only scans for "common" ports (the 1000 most common ports per protocol I believe). Since 789 is not a common port it isn't found. If you do

nmap -A -vv -p- ip

it should scan ports 1-65535.

Here is the nmap documentation that tells what ports are scanned by default: http://nmap.org/book/man-port-specification.html


The only way you could do that is to modify your nmap's services file, which isn't recommended. The -A option runs advanced options, including service detection, OS detection, tracerouting, etc - it doesn't scan the full range. If you want to scan all 65k ports, use the option -p-. Other than that, you've just got to specify the port with -p 789. Your best option is probably to create an alias that does nmap -p 789, to save yourself time.

If you really need to change the services file (/usr/local/share/nmap/nmap-services by default), find the line that reads unknown 789/tcp 0.000075 and replace it with your program's name, and put the number on the end at 0.9, so it's the top port nmap includes. An alias would be much better though.