Odd scanning error

["Kevin Nault" <prof.morbius () gmail com>]

I am using nmap version 4.76 on Windows XP (SP 3, fully up-to-date as of 30
Sept '08) on an HP/Compaq nx8230 laptop with a Broadcom 5700-series Ethernet
NIC and an Intel 2200BG wifi NIC.

Any network scan I do returns every address (empty or full) as having a
Lanner Electronics ethernet card with a MAC address of 00:90:0B:0D:72:6F --
whether the device exists or not, responds or not, and regardless of what
NIC and MAC the device actually has.  Every address (whether a device exists
there or not) is also reported as having TCP port 1720 (H.323/Q.931)
open|filtered.  If I don't include 1720 in the TCP port list, all ports
report as "filtered".  Devices which do exist report their port lists
accurately, though 1720 will be added to the list if it is scanned for.

I have a custom-built computer physically next to this one, plugged into the
next port on the same switch, with the same OS, running nmap 4.20 that does
not do this -- MAC addresses, the absense of devices, and the state of port
1720 are reported accurately.

The only IDS/IPS device on this network is a SonicWall firewall running
current software, but its MAC is 00:06:B1:XX:XX:XX (different last three
bytes from the Lanner address above).

I love nmap and use it at least weekly.  Help?

-- 
Religion, or the duty which we owe our Creator, and the manner of
discharging it, can be directed only by reason and conviction, not by force
and violence; and therefore all men are equally entitled to the free
exercise of religion, according to the dictates of conscience.
 -- James Madison

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org