Security Basics mailing list archives

IPID sequencability class is: All zeros (Nmap Idle Scan with zombie host)


From: "Simon Jolle \"sjolle\"" <urandomdev () gmail com>
Date: Sat, 08 Dec 2007 22:14:46 +0100

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Security specialists

I try to spoof packets from another host (in my lab environment). Its a
Windows XP SP2 machine. In nmap this feature is called idle scan.

# nmap -P0 -sI x.x.x.x:443 example.com
Starting Nmap 4.20 ( http://insecure.org ) at 2007-12-08 22:03 CET 
Idlescan zombie 192.168.111.113 (192.168.111.113) port 443 cannot be
used because IPID sequencability class is: All zeros.  Try another
proxy. QUITTING!

What does the error message "port x cannot be used because IPID
sequencability class is: All zeros" mean?

I tried several different ports.

cheers
Simon
- --
actually, I think Windows Vista has done more than virtually any OS
release to promote the use of Linux (Slashdot Kommentar, 4. Oct 07)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHWwk2EMN/lNE/wrwRAi9VAJ9iRTJXLzhFNTLeWX82k7fWb5kBnQCfVU1V
R9J5j5CjxA2tlZp5XW95WVU=
=hB3C
-----END PGP SIGNATURE-----


Current thread: