Re: [NSE] broadcast-ping

[Patrik Karlsson <patrik () cqure net>]

On Jul 10, 2011, at 6:40 PM, Gorjan Petrovski wrote:

> In the attachment you may find a new optimized version of the
> broadcast-ping script. This version runs a dedicated thread for each
> network interface. For each interface, first it opens the pcap socket,
> then dispatches all the probes and after all of them are dispatched it
> reads from the pcap socket.
>
> Does anyone think this is a bad approach?  (I was originally afraid
> that we might lose packets if the pcap buffer is too small)
>
> I've also included the info in the description that Toni and I agreed on.
>
> Comments are welcome and appreciated :)
>
> Cheers,
> Gorjan
> <broadcast-ping.nse>_______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://seclists.org/nmap-dev/


Hi Gorjan,

The script works for me, however running it with -d3 I saw that a thread was crashing due to:
scripts/broadcast-ping.nse:160: Error compiling our pcap filter: expression rejects all packets

Looking a bit closer into the problem I noticed that the script seems to enter broadcast_if twice for the interface en0.
The first time the if_table.address contains an ipv4 address and the second time with an ipv6 address.
I'm running the script on OS X. Let me know if you need any more information.

//Patrik
--
Patrik Karlsson
http://www.cqure.net
http://www.twitter.com/nevdull77

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/