Re: IPv6 host discovery Bug in 6.47 -- perhaps newer versions

[Daniel Miller <bonsaiviking () gmail com>]

Allen,

Thanks for reporting this. We were aware of a problem sending raw packets
on FreeBSD 10 and later, because of a change in network address byte order,
but that results in no packets being sent at all. I'm not sure what could
be causing the problem you're describing, but please answer a few more
questions for us, and we will try to debug:

1. Is there any way at all that you can use 6.49BETA5 for this test? It is
always much easier to debug the current release than to work with an older
release, and you will get a more capable product as a whole.

2. What is the output of this command, and what does tcpdump show?: nmap -d
--packet-trace -sn -n scanme.nmap.org

3. Are you running Nmap with root privileges every time? The default
behavior when root privileges are not available is to try a TCP connection
to ports 80 and 443, without ICMP probes.

4. Is there anything unusual about your network environment? For example,
when my FreeBSD VM was running under Oracle VirtualBox with NAT, VirtualBox
dropped the ICMP Timestamp Requests and intercepted the raw TCP packets,
trying to perform a complete TCP handshake instead of passing along the raw
SYN and ACK packets expected.

Dan

On Sat, Sep 26, 2015 at 6:17 PM, Allen Landsidel <landsidel.allen () gmail com>
wrote:

> It appears that when scanning a host with ipv6, if you don't specify any
> discovery options, that only the port 80 and port 443 checks described in
> the man page are actually tried -- the ICMP echo request isn't. Scanning
> with "nmap -6 -PE host::addr" works fine and detects the host is up, but
> scanning with just "nmap -6 host::addr" does not.
>
> Tcpdump indicates only the 80 and 443 packets are being sent, while the
> man page indicates the ICMP echo request is also tried.
>
> Using FreeBSD, so I don't know if this is fixed in 6.48 or 6.49, as 6.47
> is the latest version available in ports.
>
> _______________________________________________
> Sent through the dev mailing list
> https://nmap.org/mailman/listinfo/dev
> Archived at http://seclists.org/nmap-dev/
_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/