Re: Nmap

[David Fifield <david () bamsoftware com>]

On Tue, Jan 10, 2012 at 05:37:02PM +0000, Justin Store wrote:
> Hello,
>
> I'm having issues with nmap reporting different results each time it
> is run. For example, if run a ping sweep on the subnet I will get a
> different amount of hosts online with each scan. I know my hosts
> aren't going down and I can even ping them using windows. I'm just
> wondering if you have heard of this or have any ideas as to why this
> is happening. Port scan's are consistent but arp/ping sweeps are not.
> I was wondering if it was something with my switches since arp isn't
> reliable and tcp is but I don't think it's that either as we have
> decent managed switches and no other network issues. There are only
> about 40 devices on the network but nmap will tell me anywhere from 20
> to ~40. If this question is better directed elsewhere, please let me
> know.

It will help if you can show us the exact command you're running as well
as some sample output.

Try using the -d or --packet-trace options to see what is going on. Use
--send-ip to disable ARP scan and try other ping options.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/