Re: Nmap 6 fails to initialize on Windows xp sp3

[David Fifield <david () bamsoftware com>]

On Wed, May 23, 2012 at 10:41:01AM +0200, Venkataramanappa Sathyanarayana wrote:
> Hi David,
>
> Please find below the traces asked.
>
> 1) nmap --route-dst 2001:470:9388:4034:5a98:35ff:fe19:37fe
> 2001:470:9388:4034:5a98:35ff:fe19:37fe
>
> eth0 eth0 srcaddr :: direct
>
> 2) nmap -6 --packet-trace 2001:470:9388:4034:5a98:35ff:fe19:37fe
> Starting Nmap 6.00 ( http://nmap.org ) at 2012-05-23 10:31 Romance Daylight Time
> SENT (0.3590s) ICMPv6 (58) :: > ff02::1:ff19:37fe (type=135/code=0) hopl=255 flow=0 payloadlen=32
> SENT (0.5630s) ICMPv6 (58) :: > ff02::1:ff19:37fe (type=135/code=0) hopl=255 flow=0 payloadlen=32
> Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
> Nmap done: 1 IP address (0 hosts up) scanned in 0.78 seconds
> 3) nmap --iflist
>
> Starting Nmap 6.00 ( http://nmap.org ) at 2012-05-23 10:16 Romance Daylight Time
> ************************INTERFACES************************
> DEV  (SHORT) IP/MASK                                   TYPE        UP   MTU  MAC
> eth0 (eth0)  192.168.1.66/24                           ethernet    up   1500 B8:AC:6F:2E:C3:D3
> eth0 (eth0)  2001:470:9388:4034:2dde:5925:6618:6744/64 ethernet    up   1500 B8:AC:6F:2E:C3:D3
> eth0 (eth0)  2001:470:9388:4034:baac:6fff:fe2e:c3d3/64 ethernet    up   1500 B8:AC:6F:2E:C3:D3
> eth0 (eth0)  fe80::baac:6fff:fe2e:c3d3/64              ethernet    up   1500 B8:AC:6F:2E:C3:D3
> eth1 (eth1)  192.168.239.1/24                          ethernet    up   1500 00:50:56:C0:00:01
> eth1 (eth1)  fe80::250:56ff:fec0:1/64                  ethernet    up   1500 00:50:56:C0:00:01
> eth2 (eth2)  192.168.41.1/24                           ethernet    up   1500 00:50:56:C0:00:08
> eth2 (eth2)  fe80::250:56ff:fec0:8/64                  ethernet    up   1500 00:50:56:C0:00:08
> lo0  (lo0)   127.0.0.1/0                               loopback    up   1520
> tun0 (tun0)  fe80::ffff:ffff:fffd/64                   point2point down 1280
> tun1 (tun1)  (null)/0                                  point2point up   1280
> tun2 (tun2)  fe80::5efe:c0a8:142/64                    point2point up   1280
> tun2 (tun2)  fe80::5efe:c0a8:2901/64                   point2point up   1280
> tun2 (tun2)  fe80::5efe:c0a8:ef01/64                   point2point up   1280
> lo1  (lo1)   ::1/64                                    loopback    up   1500
> lo1  (lo1)   fe80::1/64                                loopback    up   1500
>
> **************************ROUTES**************************
> DST/MASK           DEV  GATEWAY
> 255.255.255.255/32 eth2 192.168.41.1
> 255.255.255.255/32 eth1 192.168.239.1
> 192.168.41.1/32    lo0  127.0.0.1
> 192.168.1.66/32    lo0  127.0.0.1
> 192.168.1.255/32   eth0 192.168.1.66
> 192.168.41.255/32  eth2 192.168.41.1
> 192.168.239.1/32   lo0  127.0.0.1
> 192.168.239.255/32 eth1 192.168.239.1
> 255.255.255.255/32 eth0 192.168.1.66
> 192.168.1.0/24     eth0 192.168.1.66
> 192.168.41.0/24    eth2 192.168.41.1
> 192.168.239.0/24   eth1 192.168.239.1
> 127.0.0.0/8        lo0  127.0.0.1
> 224.0.0.0/4        eth1 192.168.239.1
> 224.0.0.0/4        eth2 192.168.41.1
> 224.0.0.0/4        eth0 192.168.1.66
> 0.0.0.0/0          eth0 192.168.1.254

I wonder if this could also be caused by r24413. On Windows XP, we don't
have a way of getting IPv6 routes because the GetIpForwardTable2
function is missing. But when scanning this directly connected target, I
would expect the code to use a source address of 2001:470:9388:4034:2dde:5925:6618:6744.

Does setting the source address work for you as a workaround?

nmap -6 -S 2001:470:9388:4034:2dde:5925:6618:6744 --packet-trace 2001:470:9388:4034:5a98:35ff:fe19:37fe

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/