Odd results

[check <check () imjc com>]

Hi - 

I was testing some IP addresses the other day that I knew shouldn't be
accessible and although valid addresses, are probably not routable
(certainly ping fails and traceroute shows them to be unreachable
occasionally or just times out)

I ran a UDP scan using -sU -O -v -v -P0 - this took over a day to complete -
but finally came back with a whole bunch of open ports - between about 10
and 25 (I tested 3 separate IP addresses) - apparently a random spread.

I'm pretty sure the results are anomalous - as I know exactly what services
are actually running on these IP addresses - and it isn't any of the ones
the UDP scan returned.

Also - a scan using -sS against the same IP address finishes in a few
minutes and reports all ports as filtered.

I was just wondering why I got the open ports with the UDP scan?

TIA

Mike

---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List run by ezmlm-idx (www.ezmlm.org).