Printable View
well, not really, i just named it that to get attention since i got almost no responses to my last thread. i've tried using the windows nt and linux versions of nmap on my comp and they both just hang right after they get to the "initiating scan, host seems to be up... thats good" phase. i've tried lots of different options and scans on different hosts, etc. and it still does the same thing... can somebody plz help me? :( i really wanna start using nmap since it has so much cool functionality
Well I have never been able to get Nmap to work correctly on my win system... I don't know what you are doing wrong on the linux system... Is everything configured correctly?
yes, i have internet access and everything configured good on the linux system. i have internet access and i can ping/telnet to a host, but nmap messes up for some reason
Well... It's beyond me then... Did you try taking it off and putting it back on? Are you certain you have the newest version? Maybe your ISP blocks portscans... Check with them too...
Since negative went through so much trouble to create a (fantastic) search engine for the tutorials, you might want to give that a try:
http://www.neg.be/index/search.php?q=nmap
thehorse13 did a nice series of tuts....
i dont need a tutorial on how to use nmap, i need to figure out why it wont work. no matter what i do, it hangs after it sees that the host is up. other port scanners work fine, but this one has a problem.
I've never had any trouble getting it to work on Win, however it's much better on *nix. What version of winpcap are you running? Which release of NMAP? In which order did you install it, etc. etc. a little detail would help....
i got nmap(v3.5) first, it wouldnt work. then i got winpcap(dunno what version). nmap worked(slowly) until i restarted my comp, then it wouldnt work anymore. i have a linux boot cd(PHLAK) that has nmap on it so i booted up with it and tried some scans and it did the same thing(hung).
this raises a red flag for me, because many network tools rely on a very specific version of winpcap. I had terrible problems, for example, when I tried to run Ethereal using anything later than winpcap 2.5, and Cain and Abel won't tolerate any version earlier than 3.1b.Quote:
then i got winpcap(dunno what version)
I just checked the changelog at insecure.org, and the latest version of NMap apparently included support for WinPCap 3.1b - if you haven't already, try uninstalling NMap AND WinPCap, and starting over with those versions.
Just a lesson from my experience, hope it's helpful.
but why did it have the same problem on phlak then? ill see what version i have tho
--its wincap 3.1 beta
if i specify a single port, it works fine(but it takes about 2 minutes), but if i do a range it doesnt work. for example, i scanned google.com from ports 1-100 and it said that all the ports were filtered. i know that it has port 80 open, i was just on their site on port 80. what gives?
It takes time sometimes depending on devices between you. When I do scans at home it can take up to 15 minutes because my little cheap router "pooches" when I run scans (I don't think it can handle all the data). I don't think nmap is "hanging up" but rather it's taking time for all the data to return (this will be especially true if you are scanning outside your lan). Next time, run it and go off for coffee or something.
The first thing I would do is ditch the beta version of winpcap.
From the Insecure site (In bold writing).
"Please avoid Winpcap 3.1-BETA or newer because a a recent change is incompatible with Nmap 3.50. "
Use this one:
http://winpcap.polito.it/install/bin/WinPcap_3_0.exe
The second thing I would do is grab the command line version if you plan on using Nmap on W32.
As for hanging, I can tell you for sure that firewalls, routers and any number of devices will slow NMAP to a crawl depending upon which switches you use. For those who use Nessus with Nmap scans, you know that several subnets with routers and/or firewalls can take hours to scan.
The point is, before you claim that it's not working, try a scan locally against a desktop/laptop sitting on the same *hub* as your Nmap scanner is on. I bet you'll have much better results. That is, after you install all of the *proper* components.
PS
That's a shitty way to get people's attention. If I were you, I'd change the way you get attention here or you'll find yourself with a nice pile of negs.
If speed is an issue, then there are different speed settings -
1>paranoid
2>sneaky
3>polite
4>normal
5>agressive
6>insane
1 being the slowest and 6 being the fastest... That wont fix your problem though if its with NMAP.
Why the hell do you think google doesnt show up! its a massive professional company who probably have a really professional and up to date security team, methods and policy. Its not surprising that they can defeat your crud nmap scan on them....
Its probably not a good idea to scan large corporations either, last year there was a big thing about how port scans are illegal, I dunno what googles view on it is.
i2c
Uhhh.. where? I don't think this was ever resolved in courts and AFAIK, in North America, it is legal (may not be allowable under the AUP however).Quote:
Its probably not a good idea to scan large corporations either, last year there was a big thing about how port scans are illegal, I dunno what googles view on it is.
I don't think it's necessarily NMAP but rather the devices in between. This won't solve it if it's the devices themselves causing issue. Perhaps if the scans were done locally (try it on your own machine nmap localhost and see how long it takes). Factors that can interfere would be things like CPU speed, NIC "oddities" (I've found some NICs are "flaky" with NMAP and others just sweet), devices between you and the target and which nmap it is (Windows is known to be flaky and bad; Linux tends to be better)Quote:
1 being the slowest and 6 being the fastest... That wont fix your problem though if its with NMAP.
PS...
One more thing...
C:\Nmap>nmap -v -sS -p 80 www.google.com
Starting nmap 3.48 ( http://www.insecure.org/nmap ) at 2004-05-08 07:05 Eastern
Daylight Time
Host 216.239.41.99 appears to be up ... good.
Initiating SYN Stealth Scan against 216.239.41.99 at 07:05
Adding open port 80/tcp
The SYN Stealth Scan took 0 seconds to scan 1 ports.
Interesting ports on 216.239.41.99:
PORT STATE SERVICE
80/tcp open http
Nmap run completed -- 1 IP address (1 host up) scanned in 16.033 seconds
C:\Nmap>
sorry MsMittens, should have done my background research first. I basically meant that last year there was a court case as i think you imply in your post, that happen in georgia, but port scans were deemed legal by them.
For anyone interested I found this link, its a PDF btw -
www.sans.org/rr/papers/5/71.pdf
heres a HTML version by google, for anyone wanting a HTML version
http://66.102.11.104/search?q=cache:...scanning&hl=en
sorry bout that I just remembered that last year there was loads of stuff about the ethics of port scanning, and i jump to the conclusion that it had been made illegal due to technical ignorance.
i2c
It could also be that NMap is fine and you are scanning a tarpit.
i am behind a linksys router, that may be causing the lag. as for google, if i do a single port scan on port 80, it will show that 80 is open. i guess they have some kind of security measures that disconnect me if i scan multiple ports?
Several things:
1. NEVER, EVER scan from behind a NAT router or other firewall which does stateful connection tracking. The large number of connection attempts created by something like nmap, could stress it out, and cause it to run out of resources, POSSIBLY CAUSING UNINTENTIONAL DoS
2. Always use -v so you can keep track of what it's doing. nmap is not very fast if the target hosts are uncooperative, or if you are scanning down hosts with -P0. BE PATIENT.
3. Nmap is designed for Unix, but works on Windows fine provided all the various things that other posters are mentioned are set up right.
4. Never use any option which causes nmap to do spoofing, without permission of your ISP, they may decide that your machine has been owned and cut it off.
Slarty
when i scan my other comp, on the same lan, it doesnt take as long. but it still says that all ports are filtered. when i scan it with other port scanners it shows the ports that are open(which i know are open) whats with that?
Well, to know for sure what is the LAN setup? What is it you're scanning and what devices are between you and it? (Just the Linksys as the connection?) What is the NMap switches/options that you are using?
the lan setup is my 3 comps on a private network behind a linksys router which is the gateway. i've been just doing "nmap -vv -P0 -O -p 1-200 (P0 because it has a problem if i do pings and 1-200 to shorten the time the scan will take. if i do one port at a time(that i know is open) for instance, 139 is open, it will show up and say "interesting ports on this computer: 139(netbios)", status: filtered but if i do a scan from 1-200 it wont show that 139 is open, it just says that "all ports are filtered"(what filtered mean anyway?). i use netbrute and it works fine, doesnt seem to have any lag from the router or anything
if i do a connect() scan on insane mode, it goes fast and doesnt have any problems. why doesnt stealth scan work?(it always reports that the ports are all filtered) shouldnt it actually be better because its not detected? also, it seems to report the ports in a wierd order, like 80, then 1080, then 83, then 5190, then 82, 81. isnt it supposed to scan in numeric order?
quote from nmap site:
------------
Nmap requires the free WinPcap packet capture library. Obtain and install the latest version from http://winpcap.polito.it. They distribute an executable installer which makes this easy. At the time of this writing, the latest version is 3.01 and is known to work. Please avoid Winpcap 3.1-BETA or newer because a a recent change is incompatible with Nmap 3.50. The next version of Nmap will have a workaround.
-----------
This is weird since I run nmap3.50 and using winpcap 3.1 beta... The only problem I had (maybe they talk about this up here, was a long list of responses of Port "filtered"... but this happened only one time to me and only for one host, otherwise it runs ok. It seems to me you encounter the almost the same problem so the solution is to use the older version of winpcap or wait untill they fix it for the next nmap. :)
thnx