Re: Possible WinPcap problems

[John Crichton <ti86macos () hotmail com>]

On May 4, 2006, at 1:17 AM, AgentSmith15 wrote:

> Do you have a WRT54G router by any chance? Do you think that this
> could be the cause of the problem?

No, I have a netgear WGR614.

Heres the result for the packet trace scan

% nmap -p20-26 -sV -r --packet-trace scanme.nmap.org

Starting Nmap 4.03 ( http://www.insecure.org/nmap/ ) at 2006-05-04  
15:32 CDT
NSOCK (2.5630s) UDP connection requested to 192.168.0.1:53 (IOD #1)  
EID 8
NSOCK (2.5630s) Read request from IOD #1 [192.168.0.1:53] (timeout:  
-1ms) EID 18
Stats: 0:00:02 elapsed; 0 hosts completed (0 up), 0 undergoing ACK Scan
System DNS resolution Timing: About 0.00% done; ETC: 19:01  
(-596:-31:-23 remaining)
NSOCK (2.5630s) Write request for 45 bytes to IOD #1 EID 27  
[192.168.0.1:53]: .s...........62.153.217.205.in-addr.arpa.....
NSOCK (2.5670s) nsock_loop() started (timeout=500ms). 3 events pending
NSOCK (2.5670s) Callback: CONNECT SUCCESS for EID 8 [192.168.0.1:53]
NSOCK (2.5670s) Callback: WRITE SUCCESS for EID 27 [192.168.0.1:53]
NSOCK (2.7540s) Callback: READ SUCCESS for EID 18 [192.168.0.1:53]  
(169 bytes)
NSOCK (2.7540s) Read request from IOD #1 [192.168.0.1:53] (timeout:  
-1ms) EID 34
CONN (2.9600s) TCP localhost > 205.217.153.62:20 => Operation now in  
progress
CONN (2.9610s) TCP localhost > 205.217.153.62:21 => Operation now in  
progress
CONN (2.9620s) TCP localhost > 205.217.153.62:22 => Operation now in  
progress
CONN (2.9620s) TCP localhost > 205.217.153.62:23 => Operation now in  
progress
CONN (2.9630s) TCP localhost > 205.217.153.62:24 => Operation now in  
progress
CONN (2.9630s) TCP localhost > 205.217.153.62:25 => Operation now in  
progress
CONN (2.9640s) TCP localhost > 205.217.153.62:26 => Operation now in  
progress
CONN (4.2490s) TCP localhost > 205.217.153.62:26 => Operation now in  
progress
CONN (4.2500s) TCP localhost > 205.217.153.62:24 => Operation now in  
progress
CONN (4.2510s) TCP localhost > 205.217.153.62:23 => Operation now in  
progress
CONN (4.2510s) TCP localhost > 205.217.153.62:21 => Operation now in  
progress
CONN (4.2520s) TCP localhost > 205.217.153.62:20 => Operation now in  
progress
NSOCK (14.7310s) TCP connection requested to 205.217.153.62:22 (IOD  
#1) EID 8
NSOCK (14.7320s) nsock_loop() started (no timeout). 1 events pending
NSOCK (14.8150s) Callback: CONNECT SUCCESS for EID 8 [205.217.153.62:22]
NSOCK (14.8150s) Read request from IOD #1 [205.217.153.62:22]  
(timeout: 6000ms) EID 18
NSOCK (14.8870s) Callback: READ SUCCESS for EID 18  
[205.217.153.62:22] (20 bytes): SSH-2.0-OpenSSH_4.3.
Interesting ports on scanme.nmap.org (205.217.153.62):
PORT   STATE    SERVICE   VERSION
20/tcp filtered ftp-data
21/tcp filtered ftp
22/tcp open     ssh       OpenSSH 4.3 (protocol 2.0)
23/tcp filtered telnet
24/tcp filtered priv-mail
25/tcp closed   smtp
26/tcp filtered unknown

Nmap finished: 1 IP address (1 host up) scanned in 14.960 seconds


On short scans, I do not see the problem occur, only on default scan  
of all of nmaps 1670 some odd ports.





_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev