Re: Nmap says Host down when actually host is up.

["Kris Katterjohn" <katterjohn () gmail com>]

On 10/25/07, Fyodor <fyodor () insecure org> wrote:
> Does anyone know if the RFC even allows a machine receiving an ICMP
> echo request to respond from a different IP address?  I doubt that is
> allowed, but I'm not certain.
>
> Cheers,
> -F
RFC 1122 Section 3.2.2.6:

The IP source address in an ICMP Echo Reply MUST be the same
as the specific-destination address (defined in Section
3.2.1.3) of the corresponding ICMP Echo Request message.

So, no, it isn't allowed technically.

Thanks,
Kris Katterjohn

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org