Re: Minor nmap feature request with great payback

[David Fifield <david () bamsoftware com>]

On Sun, Nov 08, 2009 at 11:54:53AM -0500, Jon Kibler wrote:
> When scanning a network, it is often helpful to know the IP address
> and TTL that responded to a probe. Currently, there are several ways
> to dump packet details, but these do not exactly produce "clean"
> output.
>
> What I would like to see is a new option, "--reason-details" that
> gives not only the reason for determining that a port was
> open/closed/filtered/etc., but also gives the IP and TTL of the packet
> that sent the response.

We do already keep track of the IP address and TTL. This is from
portreasons.h:

/* stored inside a Port Object and describes
 * why a port is in a specific state */
typedef struct port_reason {
        reason_t reason_id;
        struct in_addr ip_addr;
        unsigned short ttl;
        int state;
} state_reason_t;

I seem to remember having seen "admin-prohibited from X.X.X.X" before.
Maybe there's some bug preventing it from being printed?

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/