Re: nmap, FreeBSD and ppp interface

[Lamont Granquist <lamontg () raven genome washington edu>]

also note the following in pcap-bpf.c:

#if _BSDI_VERSION - 0 >= 199510
        /* The SLIP and PPP link layer header changed in BSD/OS 2.1 */
        switch (v) {

        case DLT_SLIP:
                v = DLT_SLIP_BSDOS;
                break;

        case DLT_PPP:
                v = DLT_PPP_BSDOS;
                break;
        }
#endif

and in gencode.c:

        switch (type) {

        case DLT_EN10MB:
                off_linktype = 12;
                off_nl = 14;
                return;

        case DLT_SLIP:
                /*
                 * SLIP doesn't have a link level type.  The 16 byte
                 * header is hacked into our SLIP driver.
                 */
                off_linktype = -1;
                off_nl = 16;
                return;

        case DLT_SLIP_BSDOS:
                /* XXX this may be the same as the DLT_PPP_BSDOS case */
                off_linktype = -1;
                /* XXX end */
                off_nl = 24;
                return;

        case DLT_NULL:
                off_linktype = 0;
                off_nl = 4;
                return;

        case DLT_PPP:
                off_linktype = 2;
                off_nl = 4;
                return;

        case DLT_PPP_BSDOS:
                off_linktype = 5;
                off_nl = 24;
                return;

        case DLT_FDDI:
                /*
                 * FDDI doesn't really have a link-level type field.
                 * We assume that SSAP = SNAP is being used and pick
                 * out the encapsulated Ethernet type.
                 */
                off_linktype = 19;
#ifdef PCAP_FDDIPAD
                off_linktype += pcap_fddipad;
#endif
                off_nl = 21;
#ifdef PCAP_FDDIPAD
                off_nl += pcap_fddipad;
#endif
                return;

        case DLT_IEEE802:
                off_linktype = 20;
                off_nl = 22;
                return;

        case DLT_ATM_RFC1483:
                /*
                 * assume routed, non-ISO PDUs
                 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
                 */
                off_linktype = 6;
                off_nl = 8;
                return;

        case DLT_RAW:
                off_linktype = -1;
                off_nl = 0;
                return;
        }
        bpf_error("unknown data link type 0x%x", linktype);
        /* NOTREACHED */
}





On Thu, 21 Jan 1999, Fyodor wrote:
> On Thu, 21 Jan 1999, Savva Uspensky wrote:
>
> >     I found a problem when using nmap on FreeBSD 2.2.* with
> > ppp interface (see pppd(8)). It didn't work at all. After some
> > investigations I discovered the following:
>
> Thanks for the info!  It is always nice when people send fixes along with
> problem reports.  From your message and my (Linux PPP) experience, here
> the table I have so far:
>
>         PPP  SLIP   NOTES
> Linux   0    0      Uses DLT_RAW
> FreeBSD 4    16
> Solaris 16   ? 
> OpenBSD ?    ?      4/16 like FreeBSD?
> NetBSD  ?    ?      4/16 like FreeBSD?
>
> If anyone knows the correct values for these or other OS, please mail them
> to me.  Also, if nmap over PPP works for you now with a non-Linux system,
> let me know now.  Otherwise it might not work for you in the next rleease.
>
> I'll post a summary of the responses to the list.
>
> Cheers,
> Fyodor
>
>
> --
> Fyodor                            'finger pgp () www insecure org | pgp -fka'
> Frustrated by firewalls?          Try nmap: http://www.insecure.org/nmap/
> "It's very difficult to say anything serious or seriously truthful when the
> image of an erect penis hangs above the words." --www.christiangallery.com

-- 
Lamont Granquist                       lamontg () raven genome washington edu
Dept. of Molecular Biotechnology       (206)616-5735  fax: (206)685-7344
Box 352145 / University of Washington / Seattle, WA 98195
PGP pubkey: finger lamontg () raven genome washington edu | pgp -fka