Home page logo

nmap-dev logo Nmap Development mailing list archives

Re: Windows 7
From: Rob Nicholls <robert () robnicholls co uk>
Date: Fri, 04 Feb 2011 09:58:38 +0000

Hi Christo

On Fri, 4 Feb 2011 01:01:18 -0800, Christian Savalas wrote:
Despite this, regardless of which address I scan, (even
scanme.nmap.org) I am told that 0  hosts are up.

If you add -Pn to the Nmap commands you're running, Nmap will assume the host is up and should attempt to scan the host.

Are you able to use Windows' built in "ping" utility to ping a remote host over the internet? e.g.

ping scanme.nmap.org

Pinging scanme.nmap.org [] with 32 bytes of data:
Reply from bytes=32 time=145ms TTL=50
Reply from bytes=32 time=145ms TTL=50
Reply from bytes=32 time=145ms TTL=50
Reply from bytes=32 time=145ms TTL=50

This is one of the checks that Nmap tries to determine if a host is up. If you don't get a response then it's possible that your ISP is filtering ICMP traffic.

Are you able to view http://scanme.nmap.org using your browser? You should get a white page with a message from Fyodor in black text. If you can see this, then you can access port 80/TCP. This is another port that Nmap will try in order to determine whether a host is up. If you can't see the web page then something bad is happening.

Have you tried running Wireshark at the same time as an Nmap scan? This would let you see if packets are sent from or returned to your host. I'd be surprised if Nmap is failing to identify the returned packets, but this might happen if you have teamed NICs, for example.

If you add -d to the Nmap command you'll see some debug information, including a line like:

Packet capture filter (device eth7): dst host xx.xx.xx.xx and (icmp or ((tcp or udp or sctp) and (src host xx.xx.xx.xx)))

If you run "nmap --iflist" you should see a list of interfaces (and routes). It's possible that the correct NIC isn't picked up by Nmap and it's trying to send packets over the wrong interface (and getting nothing back). You can use -e to state the correct interface to use, e.g.

nmap scanme.nmap.org -e eth7

Starting Nmap 5.51SVN ( http://nmap.org ) at 2011-02-04 09:57 GMT Standard Time
Nmap scan report for scanme.nmap.org (
Host is up (0.15s latency).
Not shown: 993 filtered ports
22/tcp    open   ssh
25/tcp    closed smtp
53/tcp    open   domain
70/tcp    closed gopher
80/tcp    open   http
113/tcp   closed auth
31337/tcp closed Elite

Nmap done: 1 IP address (1 host up) scanned in 10.00 seconds


Sent through the nmap-dev mailing list
Archived at http://seclists.org/nmap-dev/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]