Hello. I am trying some things for security on my network and am trying to find out the correct way in which to use nmap or nc to locate one real port that is listening amongst a range of false ports. Right now I can scan my system with nmap and I have used nemesis and some scripts to make it look like I have several open ports when only one of them is truly accepting connections.

To clarify what I'm doing: say I do an nmap of my system, 'nmap -T polite -p 11500-12000 192.168.1.53' it shows a bunch of ports as open even though they are just strings as I have dropped all original port scan packets and replaced them with injected packets using nemesis... only one of the ports listed is really open.

Now I want to play the attacker and try to locate the real port using nmap or netcat. However, every command I have tried does not give me the answer. Is there a way to do this?

I've tried this command which I thought might locate it but it doenst seem to work:

I used -t because in this case the real port is a telnet port. Shouldn't -t be used with netcat when scanning for telnet negotiations?
 
Any help is appreciated.