#36 Source IP = 0.0.0.0 when using Nmap Win32 -sP option

nmapwin
closed-rejected
Jens Vogt
nmap (8)
5
2003-02-24
2003-02-11
Anonymous
No

Hi,

On a Win2K system with WinPcap v3.0 Beta installed,
the command-line versions of Nmap for Win32 (both v3.0
and 3.10 Alpha 7) have buggy behavor when sending an
ICMP Echo Request to see if a system is online before
scanning. For some reason the Source IP for the
outgoing ICMP packet gets set to 0.0.0.0, you can see
this behavior with any sniffer (WinDump in my case).
However, the follow up TCP Ack packet that Nmap
sends to port 80 (in addition to the ICMP Echo Request)
does have the correct Source IP address.

This behavior is easier to see if you use the -sP option.

Is this a known bug??

Thanks!

Discussion

  • Jens Vogt
    Jens Vogt
    2003-02-24

    • labels: 427516 --> nmap
    • assigned_to: nobody --> vogje02
    • status: open --> closed-rejected
     
  • Jens Vogt
    Jens Vogt
    2003-02-24

    Logged In: YES
    user_id=545266

    Please report this to the nmap mailing list at
    www.insecure.org. This is not an nmapwin error, but an nmap
    error. nmapwin is only a GUI around the normal nmap
    command line tool.