nmap bug? - ip proto 0xff in syn pckts on ADSL connection

[google <stanilewicz () gmail com>]

Hi,

I've tested both 4.20 and 4.21alpha, as well as 4.11 and 4.0 versions.
I'm  running XP SP1 machine (build 2600), and my connection is through
ADSL  SpeedTouch  330  modem  (latest  drivers). I used also cFosSpeed
driver and wipfw firewall, but after unstallation the problem remained
the same. I also tried to downgrade winpcap from 4.0 to 3.1.

Nmap  sends packets with 0xff as IP protocol (offset 0x17 in the whole
packet),  when it check hosts for being up, AND when it scans with SYN
scan (by default).

So I have to use ALWAYS -sT -P0 options, then nmap works.

BUT....  on  THE  SAME  MACHINE, I have also Ethernet card, and when I
connect  through  it, NMAP works correctly, and packets are formed OK.
OK,  so  the fault maybe is on the drivers side. But why (on ADSL) the
CONNECT scan works, it has to send the same SYN packet first...?

I  can  provide more information about any software/hardware component
if you wish.


-- 
Best regards,
 Rafal Stanilewicz


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org