Re: [NSE] Raw ethernet frame questions and NSE library questions

[kx <kxmail () gmail com>]

Thanks so much for the replies!

> Do you actually need to the ethernet frames?

No, for this I just need raw IP. So I will definitely look at your
branch and script. But I can see wanting raw ethernet in the future.
The dnet methods are perfectly fine and work, I just want handier
packet construction functions.

> The only problem is right now it doesn't work on machines with broken raw
> sockets (the Windows).

Yep, that is where I am at right now.

> I remember you sending patches for Windows before...

Yeah, I am sort of twisted that way. I realize there are far better
suited OSes to run Nmap on,  but I think keeping up Windows
compatibility is worthwhile. And given that there are so many better
developers on the list, if I trudge through Windows bugs etc... it is
probably an ok niche for me.

> ...hopefully you can give this a try on a different OS until I can add this stuff.

Linux VMs for the win. No problem.

> Why not use Nmap's existing functionality for sending IP packets
> (e.g. send_ip_raw() or, at a lower level, send_ip_packet())?  That way
> Nmap decides whether to send it on the raw device by building an
> ethernet frame or to use raw IP packets, based on the capabilities of
> the system (e.g. now raw sockets on Windows) and user options
> (--send-ip, --send-eth)?

Kris, are you going to poke at these? I'll look at these plus Kris's branch.

Cheers,
  kx

On Thu, Feb 4, 2010 at 4:10 PM, Kris Katterjohn <katterjohn () gmail com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 02/04/2010 02:30 PM, majek04 wrote:
> > On Thu, Feb 4, 2010 at 16:58, Kris Katterjohn <katterjohn () gmail com> wrote:
> > > Do you actually need to the ethernet frames?  Other than because Nmap trunk
> > > requires it for raw sending?
> >
> > Take a look at promiscuous.nse. It requires raw ethernet frames.
>
> Sorry, I think you misunderstood.  I didn't mean replace ethernet sending with
> the raw IP sending, convert existing ethernet-requiring scripts, or whatever
> else.  I was asking if kx's script itself actually required anything at the
> ethernet level or if writing it with raw IP sending would be better.
>
> > Cheers,
> >   Marek Majkowski
>
> Thanks,
> Kris Katterjohn
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iQIcBAEBAgAGBQJLazfBAAoJEEQxgFs5kUfuIqcP/jNWQdIEMMd2bpagVXw9GX+K
> e0nRx15cRI3zB69qF0og1fxblO5mDP6kAsElNc8gRyw9CslcZHKVTKtwBUckYnr7
> MaOYcLfl7hWrYUqUFCbk5ZADgPRIiCN2c96AsZEnOEtxt4va0VPLoVl+soyOMprb
> TfwzuQPGt8iBMW2gUoYNDMumpOMBfyap0FQpSBWRmyBpm6px60NWOWnTLPj6rGSz
> WQTUvlC4B+uZsPSm4HI5ymXYZp7hr6p4w+ahraZAqGiwJ0KA/pKQf3uOzgrTl7A+
> szAjy1A74XWeY8uAYLSQrV6eom0Kv3mmYBbegnDeBJUAJ1EEQydpms4WyHs5v7os
> sBenBYKbfQSOpLv1pGsEKJnkgcOzaq+PwJEk0LhhNRAeykt8ch+GWtAiZ7F73v3/
> h+8JX+2AiN/3wFJRgRYWnKsyfhxIOrXgkl3KYfznZkvOlytqD85RQdZedDdloTS4
> DGCCqxA/2pdPgLEkjxpDXOeYIb/loenKi13+/ciZ5w/l9LOyATz5Yc8+cZf3qhlw
> F89ah4SFuhnMkP2MEk4oetWDhle61VbEZGcCAGK10jIaSYq7px7R9aSiBW2fXvhT
> B4wT+WjCfeBpBCsXEGzawRuYitAriZvatNh6+CaqbWiyCDYgi++zDtjQN+G53ZBr
> gpIPvFOvuBbL4cey5+au
> =r/qb
> -----END PGP SIGNATURE-----
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/