On a Win2K system with WinPcap v3.0 Beta installed,
the command-line versions of Nmap for Win32 (both v3.0
and 3.10 Alpha 7) have buggy behavor when sending an
ICMP Echo Request to see if a system is online before
scanning. For some reason the Source IP for the
outgoing ICMP packet gets set to 0.0.0.0, you can see
this behavior with any sniffer (WinDump in my case).
However, the follow up TCP Ack packet that Nmap
sends to port 80 (in addition to the ICMP Echo Request)
does have the correct Source IP address.
This behavior is easier to see if you use the -sP option.
Is this a known bug??