Re: Variety of bugs in nmap-4.20

On Wed, 20 Jun 2007 02:29:02 +1000 plus or minus some time Chris Drake
<christopher_at_pobox.com> wrote:

> Hi,
>
> I'm Running the latest nmap-4.20 built from source
> on RedHas AS4 update 4
>
> Linux 2.6.9-42.ELsmp #1 SMP Wed Jul 12 23:27:17 EDT 2006 i686 i686 i386
> GNU/Linux
>
> 1. I specifically ask it to send one ICMP echo request, however, it
> sends none, instead sending only an ARP:
>
> # /usr/bin/nmap -n --packet_trace -sP -PE 123.123.252.164
>
> Starting Nmap 4.20 ( http://insecure.org ) at 2007-06-19 14:56 UTC
> SENT (0.0370s) ARP who-has 123.123.252.164 tell 123.123.252.162
> RCVD (0.0390s) ARP reply 123.123.252.164 is-at 00:0C:29:DA:5E:9F
> Host 123.123.252.164 appears to be up.
> MAC Address: 00:0C:29:DA:5E:9F (VMware)
> Nmap finished: 1 IP address (1 host up) scanned in 0.150 seconds
>

Although have obscured the IP, you must have scanned a host on your same
Ethernet segment. If you scan a host across a L3 hop you'll get the
behavior you expect. This is not a bug, it is the nature of layered
networking.

Brandon

-- 
Brandon Enright
Network Security Analyst
UCSD ACS/Network Operations
bmenrigh_at_ucsd.edu

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org