nmap oddity - Page 2
Page 2 of 2 FirstFirst 12
Results 11 to 16 of 16

Thread: nmap oddity

  1. #11
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,883
    Soda, what does your Ethereal capture filter look like? I see 2 SYN packets used with T1 & T5.

    --TH13
    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

  2. #12
    I haven't been touching the filters, and only 3 packets were sent during the T1 scan. SYN - SYN/ACK - RST. The T5 scan makes 6 packets.

    I haven't seen T1 send 2 SYNS right off the bat yet. Only T1 has been doing that.

  3. #13
    Super Moderator
    Know-it-All Master Beaver

    Join Date
    Jan 2003
    Posts
    3,914
    Hey Hey,

    I'm seeing a single SYN on each one... then a SYN ACK back.. and then the RST...

    Here are the packet captures I did.. named for the various commands that I ran.... You can compare them with yours if you so desire.

    Peace,
    HT
    IT Blog: .:Computer Defense:.
    PnCHd (Pronounced Pinched): Acronym - Point 'n Click Hacked. As in: "That website was pinched" or "The skiddie pinched my computer because I forgot to patch".

  4. #14
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,883
    I should been a little more clear...

    Each test yielded 1 SYN (total of 2) for each test. In other words, I had the same results as HTRegz.

    This gets me thinking that perhaps the packet capture library version may have something to do with the varied results people are seeing. No proof yet but some testing could eliminate or validate the theory...

    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

  5. #15
    Member
    Join Date
    Jun 2005
    Posts
    34
    I'm seeing the same thing as HTRegz and th13. No matter what I do to the timing only one SYN is sent out.
    to SYN, or not to SYN. That is the question. -Shakespeare?

  6. #16
    Member
    Join Date
    Jun 2005
    Posts
    34
    The only thing I can find that will allow you to send two SYN packets is using the -PS option in addition to the standard -p option.
    -PS sends a TCP SYN ping to a specified port.
    to SYN, or not to SYN. That is the question. -Shakespeare?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •