Re: Discovery issue

[martin.pilote () videotron com]

Hello Daniel,

Thanks for the follow up.

Version :
Nmap version 6.40 ( http://nmap.org )
Platform: i686-pc-linux-gnu
Compiled with: liblua-5.2.2 openssl-1.0.1e libpcre-8.31 libpcap-1.4.0 
nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select

iflist
Starting Nmap 6.40 ( http://nmap.org ) at 2013-10-31 10:27 EDT
************************INTERFACES************************
DEV  (SHORT) IP/MASK                     TYPE     UP MTU   MAC
lo   (lo)    127.0.0.1/8                 loopback up 65536
lo   (lo)    ::1/128                     loopback up 65536
eth0 (eth0)  192.X.X.X/24           ethernet up 1500  MAC
eth0 (eth0)  IPV6 ethernet up 1500  MAC

**************************ROUTES**************************
DST/MASK                     DEV  METRIC GATEWAY
192.X.X.0/24              eth0 1
0.0.0.0/0                    eth0 0      GATEWAY
::1/128                      lo   0
IPV6/128 lo   0


OS
Linux  3.11.0-12-generic #19-Ubuntu SMP Wed Oct 9 16:12:00 UTC 2013 i686 
i686 i686 GNU/Linux
ubuntu 13.10 saucy

nmap 6.4 was installed manually before i've updated the OS to the last 
version of ubuntu.

I've also checked with a computer with OS X Lion montain and i got the 
same result.

Sample :
        Nmap scan report for "IP ADDRESS"
        Host is up, received reset (0.011s latency).


So i've checked with nmap -PN --reason "networks" -oX nmap.xml to see 
witch serveur are using common port and all addresse are UP. With nmap 
version 5, that address was not up.

Wed Oct 23 13:47:30 2013        6.4     1.04    syn     tcp     1000 0  0 
1382555934      1382556193      up      user-set        0       IP ADDRESS 
ipv4 
filtered        1000    no-responses    998  
8009    6233    100000  1382559283      Wed Oct 23 16:14:43 2013 8832.17 



Martin Pilote



De :    Daniel Miller <bonsaiviking () gmail com>
A :     martin.pilote () videotron com, dev () nmap org, 
Date :  2013-10-31 10:26
Objet : Re: Discovery issue



On 10/31/2013 07:24 AM, martin.pilote () videotron com wrote:
> Hello,
>
> I searched over the web and i was not able to find out what is wrong 
with
> nmap.
> I'm doing vulnerability scan with nessus but before i'm using nmap to
> check wich IP is alive.
>
> Soo before Mars 2013, i was using nmap with -sn, --reason and results 
was
> pretty fine.
> After updated from version 5.5 to 6.4, almost all the IP is not 
considered
> as UP.
>
> I've tested yesteday with version 5.5 and 6.4 for 6300 IP :
> 5.5 = 132 are UP
> 6.4 = 1648 are UP
>
> When i check into the result, a lot of them seem to be caused by a reset
> and most of them dont have any open or filtered port.
>
> Any one have a clue ?
>
> Martin
> _______________________________________________
> Sent through the dev mailing list
> http://nmap.org/mailman/listinfo/dev
> Archived at http://seclists.org/nmap-dev/
Martin,

So that we can better diagnose your problem, would you mind sending the 
output of "nmap --version" and "nmap --iflist" (sanitized if you like)? 
There were some changes to route detection between those versions, and 
you may have an interface type that we don't handle yet. Also, 
information about your OS would be helpful.

Dan

_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/