Destination ports in protocol scan

[David Fifield <david () bamsoftware com>]

Currently, destination ports are set to o.magic_port during protocol
scan. o.magic_port is set by the -g or --source-port options--so it is
actually meant to be a source port and not a destination port.

o.magic_port is used as a source port throughout scan_engine.cc,
including during protocol scan. What this means is that when -g is used,
protocol probes have the same source and destination ports. Is there a
reason for this? Wouldn't we be better off using random destination
ports, or specific ports chosen to be likely to produce a response?

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/