Re: Suggested patch (no ARP ping on localnet with -P0)

[Andreas Ericsson <ae () op5 se>]

Martin Maèok wrote:
> On Wed, Jan 25, 2006 at 10:16:00AM +0100, Carl-Johan Bostorp wrote:
>
>
> > I came across a situation where I didn't want nmap to even do ARP ping
> > on the localnet
>
>
> Could you clarify the reason?
>
> If Nmap does not send and ARP then the OS will do it instead
> automagically ...


On windows, I think not, since nmap uses raw ethernet frames to get 
access to raw sockets there. I might be wrong though.


> because you can't send a packet through ethernet
> without knowing the target's MAC address unless you do a broadcast (am
> I wrong?). Or do you populate your local ARP table manually or so?

You're not wrong, but the arp-cache is usually populated when it comes 
time to sending, so sending arp-requests again isn't usually required, 
although it would require that nmap reads the arp-cache of the system 
instead. I'm not sure that's available to userland on windows, but it 
might be. It would still have to send arp-requests for IP's not in the 
cache though.

-- 
Andreas Ericsson                   andreas.ericsson () op5 se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev