Re: Weird Nmap Behavior

[τ∂υƒιφ * <tas0584 () gmail com>]

Hey Arvind,

If you only intend to just check whether the host are alive or not
(host discovery) then try the host discovery switches in NMAP. I
assume you are using NMAP version 5. There is difference between doing
a host discovery & a complete scan. To understand this, use the host
discovery switch & then a scan switch. Compare the results. Try to
ping an IP address that is not assigned to any system and to a system
that is blocking a ping packets. You will know what I am saying.

NMAP is just making a guess the host is up. This is then confirmed
when one port on that remote system responds to any one of the scans.
This is again cross verified when you manually check it. When an IP
hasn't been assigned to a server/device/anything there is no one
receiving the packets you sent. So NMAP tags it as all ports filtered.
I don't see any thing wrong with the behavior of NMAP. In SYN scan you
can get filtered in 2 cases. Read the NMAP manual or website for this
one.

For detailed study run wireshark when doing NMAP & check the sequence
of packet flow.

Cheers!
Taufiq
http://www.niiconsulting.com





2009/10/5 arvind doraiswamy <arvind.doraiswamy () gmail com>
> Hey Pplz,
> I wanted to check if any of you guys have come across this behavior.
> We routinely scan large networks using Nmap - so we thought we'd use
> it to also try and discover what IP's were live.
>
> Now note that this discussion covers hosts on the Internet and not on
> the LAN. So while testing out Nmap 4.76/5.00 we scanned one of our own
> IP ranges to check if it detected what was up and what was down.
>
> Now note that we know for a fact that out of the 16 IP's we scanned
> not all were live. So we did expect atleast some to be down. But
> strangely Nmap said that all 16 IP's were "up". Sure all ports were
> filtered - but the IP's were up. We're running SYN scans with a -PN
> switch as well and am quite sure it wasn't our firewall doing this -
> because we weren't doing any blocking as such( 3 IP's were live -
> ping).
>
> Now I'm a little confused - Firstly ofcourse an IP can be live while
> having say 65535 ports filtered coz its behind a firewall. Which then
> brings me to the next 2 questions:
> --- If every port is filtered and ping is blocked(Internet) how does
> Nmap decide that a host is up?
> --- How would you explain behavior like the above where I know for a
> fact an IP hasn't been assigned to a server/device/anything?
>
> Lastly if I want to test known "down" IP's are there any such IP's?
> Not misspelt domain names as of now - just test "down" IP addresses.
>
> Finally if this behavior for Nmap is how it is and can't be
> changed(due to whatever stack dependencies etc , just shooting in the
> air here) isn't this giving in accurate results? What is a workaround?
>
> Thnx
> Arvind
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
> and CEPT certs require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------



--
Cheers!
TAS

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------