Re: Bug: specified source port not honored in ncat

[David Fifield <david () bamsoftware com>]

On Tue, May 18, 2010 at 01:13:18PM -0500, Gabriel Friedmann wrote:
> Bug: Specifying --source-port (or -p) for ncat conections does not appear to
> be honored.
>
> Ncat: Version 5.30BETA1
>
> My host: Linux, CentOS 5.5
>
> Please note that the source (ghost) source port is selected to be 40967
> instead of the specified port 80.
>
> ---------Command---------
> [gabriel@ghost ~]$ *sudo ncat -vvv --source-port 80 74.125.79.99 80*
> Ncat: Version 5.30BETA1 ( http://nmap.org/ncat )
> NSOCK (0.0030s) TCP connection requested to 74.125.79.99:80 (IOD #1) EID 8
> NSOCK (0.0030s) Bind to 0.0.0.0 failed (IOD #1) EID 8
> NSOCK (0.0230s) Callback: CONNECT SUCCESS for EID 8 [74.125.79.99:80]
> Ncat: Connected to 74.125.79.99:80.
> NSOCK (0.0230s) Read request from IOD #1 [74.125.79.99:80] (timeout: -1ms)
> EID 18
> NSOCK (0.0230s) Read request for 0 bytes from IOD #2 (peer unspecified) EID
> 26

This looks like it is caused by some configuration of your system.
Notice the line

NSOCK (0.0030s) Bind to 0.0.0.0 failed (IOD #1) EID 8

That means that Ncat tried to set the source port but the operating
system did not allow it. Maybe it's because of SELinux or something
else.

Setting the source port works for me.

# ncat -vvv -p 80 google.com 80
Ncat: Version 5.30BETA1 ( http://nmap.org/ncat )
NSOCK (0.0030s) TCP connection requested to 66.102.7.104:80 (IOD #1) EID 8
NSOCK (0.1120s) Callback: CONNECT SUCCESS for EID 8 [66.102.7.104:80]
Ncat: Connected to 66.102.7.104:80.
NSOCK (0.1120s) Read request from IOD #1 [66.102.7.104:80] (timeout: -1ms) EID 18
NSOCK (0.1120s) Read request for 0 bytes from IOD #2 (peer unspecified) EID 26

And the tcpdump output:

10:38:40.991011 IP 192.168.0.21.80 > 66.102.7.104.80: Flags [S], seq 3032478975, win 5792, options [mss 1460,sackOK,TS 
val 95159737 ecr 2587190733,nop,wscale 5], length 0
10:38:41.095993 IP 66.102.7.104.80 > 192.168.0.21.80: Flags [S.], seq 990492735, ack 3032478976, win 5672, options [mss 
1430,sackOK,TS val 2587206052 ecr 95159737,nop,wscale 6], length 0
10:38:41.096088 IP 192.168.0.21.80 > 66.102.7.104.80: Flags [.], ack 1, win 181, options [nop,nop,TS val 95159842 ecr 
2587206052], length 0

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/