Re: bug report

[Brandon Enright <bmenrigh () ucsd edu>]

On Sun, 26 Jul 2009 21:45:09 +0100 or thereabouts "Rob Nicholls"
<robert () everythingeverything co uk> wrote:

> Is it listing a different MAC address for every IP that's up, or is
> it the same IP no matter what? I think I've seen that behaviour once
> before with a wireless access point that appeared to return its own
> MAC address for every local IP address (even, as you've seen, when
> the host doesn't exist).
>
> You can add --reason to the command line to see why Nmap thinks the
> host is up, but if it's an IP on your subnet then it basically has to
> be an "arp-response", which means that something on your network is
> returning an ARP response to you and claiming to be that IP.
>
> For reference, I couldn't reproduce your issue with Nmap 5.00 on my
> copy of Windows XP SP3 (the service pack shouldn't make a difference).
>
> Rob

The behavior you're describing is called proxy-arp.  People generally
turn it on when they don't want to have to be bothered with configuring
the right subnet mask for machines.

Brandon


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org