MAC OS X Firewire Issue

[kronicd <kronicd () kronicd net>]

Hi,

After attempting to use the latest version of nmap (I tried both 4.20
and 4.21ALPHA4) I noticed I would get the following error whenever
attempting to perform a scan that required root privileges (syn
scanning etc).

$ sudo ./nmap -sS 192.168.1.1

Starting Nmap 4.21ALPHA4 ( http://insecure.org ) at 2007-06-18 14:36 WST
getinterfaces: Failed to obtain MAC address for ethernet interface (fw0)
QUITTING!

The issue is that the fw0 (firewire ethernet interface) does not have
a mac address, and thus when getinterfaces() is being called a fatal
error is thrown when the details for the firewire interface are
collected.

Here is a diff of my quick hack to get around this issue:

2734,2736c2734,2746
<         fatal("%s: Failed to obtain MAC address for ethernet interface (%s)",
<               __FUNCTION__, mydevs[numifaces].devname);
<       memcpy(mydevs[numifaces].mac, ethaddr.data, 6);
---
>               // start krons fix (hack) for crazy mac os firewire interface
>               // its good as long as you don't actually want to use nmap on an fw interface
>               if((mydevs[numifaces].devname[0] != 'f') && (mydevs[numifaces].devname[1] != 'w')) { // if device does 
> not start with fw
>                 fatal("%s: Failed to obtain MAC address for ethernet interface (%s)",
>                       __FUNCTION__, mydevs[numifaces].devname);
>
>               } else {
>                       for(int k = 0; k<6; k++) {
>                               mydevs[numifaces].mac[k] = mydevs[0].mac[k]; // copy loopback device mac address to 
> firewire mac address -- whoa!
>                       }
>               }
>                       memcpy(mydevs[numifaces].mac, ethaddr.data, 6);

A more elegant solution to this issue is desirable. (I have some time
off in the next few weeks, if nothing has been done by then I'll try
to work out a better solution).

It should also be noted that other mac os users have identified this
problem previously and posted about it on the list, the response has
been that this issue is related to not having enough free bpf devices
as when the --iflist args are used the following results:

nmap --iflist

Starting Nmap 4.21ALPHA4 ( http://insecure.org ) at 2007-06-18 14:33 WST
getinterfaces: Failed to open ethernet interface (en0). A possible
cause on BSD operating systems is running out of BPF devices (see
http://seclists.org/lists/nmap-dev/2006/Jan-Mar/0014.html).
QUITTING!

Under OSX (by default) BPF devices are only available to root users
and as such this error is thrown. Perhaps the 'sorry dude you need
root for that' message should be displayed in this case.

Regards,

kronicd

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org