Re: Closing socket when input file ends?

[David Fifield <david () bamsoftware com>]

On Tue, May 01, 2012 at 11:12:11AM -0800, Britton Kerin wrote:
> Hi guys,
>
> First: loving nmap/ncat a lot.  Thanks all.
>
> I'm using ncat with an embedded device like so:
>
>    nmap 192.168.1.42 50000 <query.bin >response.bin
>
> The thing is it never seems to close the connection.  I can use --idle-timeout
> to kill it but I sort of wonder why it doesn't automatically close the socket
> when input EOF stdin like cat does?

This is by design. We can't close the socket when local input ends
because the remote host may still be sending. There's a litte bit about
it here:
http://nmap.org/ncat/guide/ncat-other-options.html
The only exception is with --send-only, where we know we will ignore
anything from the remote host, so it's always safe to close the socket.

There's an earlier discussion on this topic here:
http://seclists.org/nmap-dev/2009/q2/151
A use case where you don't want the socket closed is here:
http://seclists.org/nmap-dev/2009/q2/154

> Also, when typing in put manually I would expect CNTRL-D to send EOF,
> but I'm not sure if it does or not, or does but it doesn't close
> connection, or what.

It sends EOF. Run with the -vvv option to see the Nsock event:
NSOCK (0.4860s) Callback: READ EOF for EID 26 (peer unspecified)

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/