nmap problems on suse 9.0

[Richard Moore <rich () westpoint ltd uk>]

[ Redirected from nmap-hackers to nmap-dev  --Fyodor ]

Hi all,

There have been some problems with nmap on suse 9.0 reported on some of 
the nessus mailing lists. I have tested this with nmap 3.48 built from 
source and can confirm that there is a problem. Using tcpdump from the 
targetted host suggests that the packets nmap is generating are being 
corrupted somehow - I am not sure what might cause this. Here is a 
sample of the tcpdump output of a SYN scan:

10:43:37.826040 pugsley.westpoint.ltd.uk.51309 > fester.211: S [tcp sum 
ok] 4243794845:4243794845(0) win 1024 (ttl 44, id 5843, len 40, bad 
cksum 0!)
0x0000   4500 0028 16d3 0000 2c06 0000 c0a8 032e        E..(....,.......
0x0010   c0a8 0330 c86d 00d3 fcf3 2b9d 0000 0000        ...0.m....+.....
0x0020   5002 0400 3262 0000 0000 0000 0000             P...2b........
10:43:37.826040 pugsley.westpoint.ltd.uk.51309 > fester.wnn4_Cn: S [tcp 
sum ok] 4243794845:4243794845(0) win 2048 (ttl 53, id 54587, len 40, bad 
cksum 0!)
0x0000   4500 0028 d53b 0000 3506 0000 c0a8 032e        E..(.;..5.......
0x0010   c0a8 0330 c86d 5711 fcf3 2b9d 0000 0000        ...0.mW...+.....
0x0020   5002 0800 d823 0000 0000 0000 0000             P....#........
10:43:37.826040 pugsley.westpoint.ltd.uk.51309 > fester.759: S [tcp sum 
ok] 4243794845:4243794845(0) win 4096 (ttl 55, id 28054, len 40, bad 
cksum 0!)
0x0000   4500 0028 6d96 0000 3706 0000 c0a8 032e        E..(m...7.......
0x0010   c0a8 0330 c86d 02f7 fcf3 2b9d 0000 0000        ...0.m....+.....
0x0020   5002 1000 243e 0000 0000 0000 0000             P...$>........

I'm told suse has a bugzilla entry about this already. The options seem 
to be 1) a compiler error in the checksum code 2) a kernel issue. Has 
anyone got any ideas?

Cheers

Rich.


---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org