Page 2 of 2 FirstFirst 12
Results 11 to 16 of 16

Thread: nmap oddity

  1. July 4th, 2005, 08:45 PM #11
    thehorse13
    thehorse13 is offline
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,885
    Soda, what does your Ethereal capture filter look like? I see 2 SYN packets used with T1 & T5.

    --TH13
    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
    Reply With Quote Reply With Quote
  2. July 4th, 2005, 08:57 PM #12
    Soda_Popinsky
    Soda_Popinsky is offline
    Join Date
    Nov 2003
    Posts
    1,426
    I haven't been touching the filters, and only 3 packets were sent during the T1 scan. SYN - SYN/ACK - RST. The T5 scan makes 6 packets.

    I haven't seen T1 send 2 SYNS right off the bat yet. Only T1 has been doing that.
    Reply With Quote Reply With Quote
  3. July 4th, 2005, 10:18 PM #13
    HTRegz
    HTRegz is offline
    Senior Member
    Join Date
    Jan 2003
    Posts
    3,915
    Hey Hey,

    I'm seeing a single SYN on each one... then a SYN ACK back.. and then the RST...

    Here are the packet captures I did.. named for the various commands that I ran.... You can compare them with yours if you so desire.

    Peace,
    HT
    Reply With Quote Reply With Quote
  4. July 5th, 2005, 04:59 PM #14
    thehorse13
    thehorse13 is offline
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,885
    I should been a little more clear...

    Each test yielded 1 SYN (total of 2) for each test. In other words, I had the same results as HTRegz.

    This gets me thinking that perhaps the packet capture library version may have something to do with the varied results people are seeing. No proof yet but some testing could eliminate or validate the theory...

    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
    Reply With Quote Reply With Quote
  5. July 5th, 2005, 08:52 PM #15
    cashmoney
    cashmoney is offline
    Member
    Join Date
    Jun 2005
    Posts
    34
    I'm seeing the same thing as HTRegz and th13. No matter what I do to the timing only one SYN is sent out.
    to SYN, or not to SYN. That is the question. -Shakespeare?
    Reply With Quote Reply With Quote
  6. July 5th, 2005, 09:05 PM #16
    cashmoney
    cashmoney is offline
    Member
    Join Date
    Jun 2005
    Posts
    34
    The only thing I can find that will allow you to send two SYN packets is using the -PS option in addition to the standard -p option.
    -PS sends a TCP SYN ping to a specified port.
    to SYN, or not to SYN. That is the question. -Shakespeare?
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules