Printable View
if i specify a single port, it works fine(but it takes about 2 minutes), but if i do a range it doesnt work. for example, i scanned google.com from ports 1-100 and it said that all the ports were filtered. i know that it has port 80 open, i was just on their site on port 80. what gives?
It takes time sometimes depending on devices between you. When I do scans at home it can take up to 15 minutes because my little cheap router "pooches" when I run scans (I don't think it can handle all the data). I don't think nmap is "hanging up" but rather it's taking time for all the data to return (this will be especially true if you are scanning outside your lan). Next time, run it and go off for coffee or something.
The first thing I would do is ditch the beta version of winpcap.
From the Insecure site (In bold writing).
"Please avoid Winpcap 3.1-BETA or newer because a a recent change is incompatible with Nmap 3.50. "
Use this one:
http://winpcap.polito.it/install/bin/WinPcap_3_0.exe
The second thing I would do is grab the command line version if you plan on using Nmap on W32.
As for hanging, I can tell you for sure that firewalls, routers and any number of devices will slow NMAP to a crawl depending upon which switches you use. For those who use Nessus with Nmap scans, you know that several subnets with routers and/or firewalls can take hours to scan.
The point is, before you claim that it's not working, try a scan locally against a desktop/laptop sitting on the same *hub* as your Nmap scanner is on. I bet you'll have much better results. That is, after you install all of the *proper* components.
PS
That's a shitty way to get people's attention. If I were you, I'd change the way you get attention here or you'll find yourself with a nice pile of negs.
If speed is an issue, then there are different speed settings -
1>paranoid
2>sneaky
3>polite
4>normal
5>agressive
6>insane
1 being the slowest and 6 being the fastest... That wont fix your problem though if its with NMAP.
Why the hell do you think google doesnt show up! its a massive professional company who probably have a really professional and up to date security team, methods and policy. Its not surprising that they can defeat your crud nmap scan on them....
Its probably not a good idea to scan large corporations either, last year there was a big thing about how port scans are illegal, I dunno what googles view on it is.
i2c
Uhhh.. where? I don't think this was ever resolved in courts and AFAIK, in North America, it is legal (may not be allowable under the AUP however).Quote:
Its probably not a good idea to scan large corporations either, last year there was a big thing about how port scans are illegal, I dunno what googles view on it is.
I don't think it's necessarily NMAP but rather the devices in between. This won't solve it if it's the devices themselves causing issue. Perhaps if the scans were done locally (try it on your own machine nmap localhost and see how long it takes). Factors that can interfere would be things like CPU speed, NIC "oddities" (I've found some NICs are "flaky" with NMAP and others just sweet), devices between you and the target and which nmap it is (Windows is known to be flaky and bad; Linux tends to be better)Quote:
1 being the slowest and 6 being the fastest... That wont fix your problem though if its with NMAP.
PS...
One more thing...
C:\Nmap>nmap -v -sS -p 80 www.google.com
Starting nmap 3.48 ( http://www.insecure.org/nmap ) at 2004-05-08 07:05 Eastern
Daylight Time
Host 216.239.41.99 appears to be up ... good.
Initiating SYN Stealth Scan against 216.239.41.99 at 07:05
Adding open port 80/tcp
The SYN Stealth Scan took 0 seconds to scan 1 ports.
Interesting ports on 216.239.41.99:
PORT STATE SERVICE
80/tcp open http
Nmap run completed -- 1 IP address (1 host up) scanned in 16.033 seconds
C:\Nmap>
sorry MsMittens, should have done my background research first. I basically meant that last year there was a court case as i think you imply in your post, that happen in georgia, but port scans were deemed legal by them.
For anyone interested I found this link, its a PDF btw -
www.sans.org/rr/papers/5/71.pdf
heres a HTML version by google, for anyone wanting a HTML version
http://66.102.11.104/search?q=cache:...scanning&hl=en
sorry bout that I just remembered that last year there was loads of stuff about the ethics of port scanning, and i jump to the conclusion that it had been made illegal due to technical ignorance.
i2c
It could also be that NMap is fine and you are scanning a tarpit.
i am behind a linksys router, that may be causing the lag. as for google, if i do a single port scan on port 80, it will show that 80 is open. i guess they have some kind of security measures that disconnect me if i scan multiple ports?
Several things:
1. NEVER, EVER scan from behind a NAT router or other firewall which does stateful connection tracking. The large number of connection attempts created by something like nmap, could stress it out, and cause it to run out of resources, POSSIBLY CAUSING UNINTENTIONAL DoS
2. Always use -v so you can keep track of what it's doing. nmap is not very fast if the target hosts are uncooperative, or if you are scanning down hosts with -P0. BE PATIENT.
3. Nmap is designed for Unix, but works on Windows fine provided all the various things that other posters are mentioned are set up right.
4. Never use any option which causes nmap to do spoofing, without permission of your ISP, they may decide that your machine has been owned and cut it off.
Slarty