Re: NMAP Issue with Ping

[David Fifield <david () bamsoftware com>]

On Fri, Nov 13, 2009 at 10:46:32AM -0800, Corey Chandler wrote:
> David Fifield wrote:
> > Nmap used to send two probes for host discovery, but now it sends four
> > because that was found to be more effective. See
> > http://nmap.org/book/man-host-discovery.html.
> >
> > But when the target is on the same Ethernet network, Nmap uses an ARP
> > ping instead. 
>
> nmap determines this automatically, correct?  In other words, if I'm  
> scanning 192.168.1.0/24, and the box itself lives at an IP contained  
> within that subnet, it'll automatically switch itself over to ARP 
> pinging?

Right. See the function route_dst in tcpip.cc, the parts where it sets
rnfo->direct_connect. This code in nexthost in targets.cc does the ARP
ping if 1) it's an Ethernet interface, 2) all the targets in the group
are directly connected, and 3) --send-ip was not used.

/* First I'll do the ARP ping if all of the machines in the group are
   directly connected over ethernet.  I may need the MAC addresses
   later anyway. */
 if (hs->hostbatch[0]->ifType() == devt_ethernet &&
     hs->hostbatch[0]->directlyConnected() &&
     o.sendpref != PACKET_SEND_IP_STRONG) {
   arpping(hs->hostbatch, hs->current_batch_sz);
   arpping_done = true;
 }

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/