ping scan not accurate?

[Michael Nichols <mnichols () datanetri com>]

I used nmap to troubleshoot an issue where in an office bldg. with a shared internet subnet for tenants.
One of my clients was having ip conflicts on the WAN side of their firewall.

The subnet was 192.168.0.0/24

I used zenmap and ran a ping scan of 192.168.0.1-254
It came back saying all 254 hosts were up.

So I complained to the network administrator responsible for that subnet that it appears they need to change the subnet 
to something that can support more devices.
They came back saying that they did not believe that all the addresses were in use and the utility being used may be 
producing inaccurate results.

I then did icmp pings using the traditional ping command to random IPs and found that IPs that the nmap ping scan was 
reporting as alive were not responding.
I did another scan at a command line nmap -PE 192.168.0.1-254

Which returned back that 20 hosts were up.

I was mainly wondering why a ping scan (-sn) would be reporting a false positive.


Thanks.





_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/