Re: NMAP : Different interpretation of "filtered" ports depending on -sS or -sT options. Bug ?

[Martin Mačok <martin.macok () underground cz>]

On Fri, Jan 07, 2005 at 12:49:52PM +0000, Richard Moore wrote:

> > Actually, the connect() scan could have problems in telling the
> > difference between filtered and closed ports because when ICMP
> > DU/PU is received then connect() returns ECONNREFUSED (just like
> > when RST is received).
>
> That may be platform dependent, certainly on linux protocol
> unreachable etc. are handled fine by connect() and have their own
> errnos (which nmap uses correctly).

Really? Which errno is raised on your system when receiving ICMP DU
Port Unreachable (this is what iptables -j REJECT generates)?

On my Linux kernel 2.4.22-37mdk connect() raises ECONNREFUSED both
when RST or ICMP DU Port Unreachable is received. Quick look at
net/ipv4/icmp.c (and tcp_ipv4.c) confirms it. I have not tested it on
other systems, though...

Martin Mačok
ICT Security Consultant

---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org