Re: Fragscan not working?

[Fyodor <fyodor () insecure org>]

On Thu, Apr 08, 2010 at 01:23:23AM -0400, Michael Pattrick wrote:
> On Thu, Apr 8, 2010 at 1:02 AM, Fyodor <fyodor () insecure org> wrote:
> > On Wed, Apr 07, 2010 at 06:49:40PM +0000, Brandon Enright wrote:
> > > I suppose -f should probably imply --send-eth, at least on Linux.
> >
> > I'm not sure if Linux always does that.  Here is what the man page
> > entry for -f says about the issue:
>
> What would be the motivation not to imply --send-eth where possible on
> Linux fragmentation scans?

I agree with Brandon that it probably is a good idea.  But even if we
change the default to --send-eth in that case, we still have the issue
for non Ethernet networks.  So it would be good to understand what
conditions it happens in.  And if it turns out that there is a way to
resolve this for raw IP packets (like a sysctl or something), that
would likely be an even better solution.

But yeah, I didn't mean to sound like I was arguing against Brandon's
suggestion.  Just sending more notes about the current
situation/documentation.

Cheers,
-F
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/