Test nmap over tor with psad

Question

I have got a vps for test nmap over tor. I installed psad on the vps.

This is where 9050 port is listening (my desktop):

 roto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program 
 name    
 tcp        0      0 localhost:9050          0.0.0.0:*               LISTEN      -                   
 tcp        0      0 host.****.****:40966    tor-proxy-03.for-p:9002 ESTABLISHED -              

These are the nmap options I'm using:

sudo nmap --proxy socks4://127.0.0.1:9050 -sS -Pn 123.66.98.2 -p22,5555,6666,7777

note -Pn ( no icmp )

This is how I test my ip and it works

curl -x socks4://127.0.0.1:9050  ifconfig.io

this is what psad returns:

Mar 22 20:33:59 vm5656.server.net psad[14413]: src: 75.xx.xxx.2 signature match: 
"P2P Napster Client Data communication attempt" (sid: 563) tcp port: 6666
Mar 22 20:33:59 vm5656.server.net psad[14413]: src: 75.xx.xxx.2 signature match: 
"P2P Napster Client Data communication attempt" (sid: 564) tcp port: 5555
Mar 22 20:33:59 vm5656.server.net psad[14413]: src: 75.xx.xxx.2 signature match: 
"P2P Napster Client Data communication attempt" (sid: 562) tcp port: 7777
Mar 22 20:33:59 vm5656.server.net psad[14413]: scan detected (Nmap -sT or -sS 
scan): 75.xx.xxx.2 -> 123.66.98.2 tcp: [5555-7777] flags: SYN tcp pkts: 9 DL: 5

The psad can read my real ip 75.xx.xxx.2 and I don't understand maybe the wrong option on nmap Can yo help me ?Thanks

Answer 1

Tor cannot help you perform a SYN scan. Tor anonymizes client TCP connections and a SYN scan does not establish a full TCP connection. In this case nmap does not use your SOCKS proxy at all as it does not establish any TCP connections.