nmap oddity

Soda, what does your Ethereal capture filter look like? I see 2 SYN packets used with T1 & T5.

--TH13

I haven't been touching the filters, and only 3 packets were sent during the T1 scan. SYN - SYN/ACK - RST. The T5 scan makes 6 packets.

I haven't seen T1 send 2 SYNS right off the bat yet. Only T1 has been doing that.

Hey Hey,

I'm seeing a single SYN on each one... then a SYN ACK back.. and then the RST...

Here are the packet captures I did.. named for the various commands that I ran.... You can compare them with yours if you so desire.

Peace,
HT

I should been a little more clear...

Each test yielded 1 SYN (total of 2) for each test. In other words, I had the same results as HTRegz.

This gets me thinking that perhaps the packet capture library version may have something to do with the varied results people are seeing. No proof yet but some testing could eliminate or validate the theory...

I'm seeing the same thing as HTRegz and th13. No matter what I do to the timing only one SYN is sent out.

The only thing I can find that will allow you to send two SYN packets is using the -PS option in addition to the standard -p option.
-PS sends a TCP SYN ping to a specified port.