Re: ip proto 0xff in syn pckts on ADSL connection

[David Fifield <david () bamsoftware com>]

On Tue, Nov 04, 2008 at 11:01:55AM -0500, jfhorn wrote:
> I'm looking for some insight into an issue (a bug, possibly with nmap)
> involving the most recent nmap (4.76), Windows (XP SP2), WinPcap
> (4.02), and a modem/dial-up adapter.
>
> PROBLEM: When attempting a TCP connect scan (-sT) to port 80 on
> www.google.com over dial-up, the system emits packets correctly, *but*
> when attempting to SYN scan (-sS) port 80 on www.google.com, the
> system emits packets with the IP protocol type set to 0xFF.

This is another symptom of an underlying Windows deficiency discussed
here:

http://seclists.org/nmap-dev/2008/q4/0257.html

Windows doesn't support raw sockets. Nmap can work around this most of
the time by using an Ethernet interface directly, but that only works
for Ethernet devices. Scans requiring raw packets (including SYN scan)
won't work on a dial-up connection. The workaround is (as you've
discovered) to use -sT for a plain connect scan. To do more than that
requires an operating system with support for raw sockets.

There is a real problem here thouch, which is that Nmap doesn't print
enough information about the situation. If you try to use --send-ip on
Windows, you get the message

        WARNING: raw IP (rather than raw ethernet) packet sending
        attempted on Windows. This probably won't work.  Consider
        --send-eth next time.

It should print out something similar (without the --send-eth)
suggestion) when it doesn't find an Ethernet device to use.

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org